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Introduction 



DESIGNED FOR IBM^OMPATIBLE 
PERSONAL COMPUTERS 

- 486SX instruction set compatible 

- Runs DOS, Windows and Unix 

- 32-bit internal / 16-bit external data path 

- 386SX bus compatible 

- 25 MHz maximum clock frequency 

LOW POWER CONSUMPTION FOR 
BATTERY POWERED APPLICATIONS 

- Software transparent suspend/resume 

- Fully static design 

- 0.10mAI^^atOMHzand5V 



♦ 4B6-CLASS PERFORMANCE 

- Up to 2.4 times faster than 386SX or 386SL 

at same clock frequency 

- Landmark 2.0 = 78.3 MHz, Norton SI 6.0 = 39.4 

at 25 MHz with no secondary cache 

- On-chip instruction and data cache 

- Single-cycle execution unit 

- 16-bit hardware multiplier 

♦ LOW VOLTAGE OPERATION 

- 25 MHz operation from 2.7-5.5 V^^ 

- Only 0.66 W at 3.0 V and 25 MHz 



The Cyrix Cx486SLC is a high-performance micro- 
processor for use in IBM-compatible computers. The 
Cx486SLC executes the 486SX instruction set and all 
operating systems designed for this instruction set 
including DOS, Windows, and Unix. 

The Cx486SLC includes a single cycle execution unit 
and a 32-bit internal data path that couple tightly to 
the on-chip 1 KByte cache. This enables the 
Cx486SLC to effectively access the cache two clocks 



faster than a zero wait-state external bus access. As a 
result, the Cx486SLC performs up to 2.4X faster than 
a 386SX or 386SL at the same clock frequency. 

The Cx486SLC bus interface is compatible with 
existing 386SX hardware designs. Both hardware and 
software controls are provided by Cyrix to support 
both the Cx486SLC cache interface and power 
management features allowing design flexibility and 
minimal changes to existing systems. 
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1 . PRODUCT OVERVIEW 

1.1 Inlreduclien 



Product Overview 






1.2 



Execution Pipeline 



The Cyrix Cx486SLC microprocessor is an 
advanced 3 2 -bit X86 compatible processor 
offering high performance and integrated power 
management on a single chip. The 486SLC is 
486SX instruction set compatible and is back- 
ward compatible with the 386SX pinout. The 
Cx486SLC provides up to 2.4X the performance 
of both the 386SL and 386SX at equal clock 
frequencies. The Cx486SLC is an ideal solution 
for battery-powered applications in that it typically 
draws 0. 10 mA while the input clock is stopped in 
suspend mode. The Cx486SLC-V version of the 
Cx486SLC offers additional power savings as it 
operates on a 3-volt as well as 5-volt power 
supply. 

The Cx486SLC supports 8, 16 and 32-bit data 
types and operates in real, virtual 8086 and 
protected modes. The Cx486SLC microproces- 
sor achieves high performance through use of a 
highly optimized variable length pipeline com- 
bined with a RISC-like single cycle execution unit, 
an on-chip hardware multiplier and an integrated 
instruction and data cache. 

The Cx486SLC microprocessor is implemented 
in 0.8 micron CMOS technology and is available 
in 20 and 25 MHz versions. Both the +5V 
Cx486SLC and +3V Cx486SLC-V versions are 
available packaged in a 100-pin bumpered quad 
flat pack (QFP). 



The Cx486SLC execution path consists of 
five pipelined stages optimized for minimal 
instruction cycle times. These five stages are: 

• Code Fetch 

o Instruction Decode 
o Microcode ROM Access 

• Execution 

• Memory/Register File Write-Back 

These stages have been designed with hardware 
interlocks which permit successive instruction 
execution overlap. 

The 16-byte instruction prefetch queue fetches 
code in advance and prepares it for decode, 
helping to minimize overall execution time. The 
instruction decoder then decodes four bytes of 
instructions per clock eliminating the need for a 
queue of decoded instructions. Sequential 
instructions are decoded quickly and provided to 
the microcode. Non-sequential operations do not 
have to wait for a queue of decoded instructions 
to be flushed and refilled before execution 
continues. As a result, both sequential and non- 
sequential instruction execution times are mini- 
mized. 

The execution stage takes advantage of a RISC- 
like single cycle execution unit and a 16-bit 
hardware multiplier. The write-back stage 
provides single cycle 32-bit access to the on-chip 
cache and posts all writes to the cache and system 
bus using a two-deep write buffer. Posted writes 
allow the execution unit to proceed with program 
execution while the bus interface unit actually 
completes the write cycle. 
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On-chip Cache 



1.3 



On-chip Cache 



The Cx486SLC on-chip cache maximizes overall 
performance by quickly supplying instructions 
and data to the internal execution pipeline. An 
external memory access takes a minimum of two 
clock cycles (zero wait states). For cache hits, 
the Cx486SLC eliminates these two clock cycles 
by overlapping cache accesses with normal 
execution pipeline activity. Additional bus 
bandwidth is gained by presenting instructions 
and data to the execution pipeline up to 32 bits at 
a time compared to 16 bits per cycle for an 
extemal memory access. 

The Cx486SLC cache is a 1 KByte write-through 
unified instruction and data cache and lines are 
allocated only during memory read cycles. The 
cache can be configured as direct-mapped or as 
two-way set associative. The direct-mapped 
organization is a single set of 256 four-byte lines. 
When configured as two-way set associative, the 
cache organization consists of two sets of 128 
four-byte lines and uses a Least Recently Used 
(LRU) replacement algorithm. 



signals. The software initiates suspend mode 
through execution of the HALT instruction. 
Once in suspend mode, the Cx486SLC power 
consumption is further reduced by stopping the 
extemal clock input. The resulting current draw is 
typically less than 0.25 mA. Since the Cx486SLC is 
a static device, no internal CPU data is lost when the 
clock input is stopped. 

1 .4.2 3-Volt Operation 

The Cx486SLC-V version of the Cx486SLC 
operates from either a 3-volt or a 5-volt supply. 
While operating with a 3-volt supply, the power 
consumed by the 486SLC-V is typically only 
30 percent of the power consumed while operat- 
ing at 5 volts. The 486SLC-V is available in both 
20 and 25 MHz speeds. 



1.4 



Power Management 



1 •4.1 Suspend Mode and Static 
Operation 

The 486SLC power management features allow a 
dramatic reduction in current consumption 
when the 486SLC microprocessor is in suspend 
mode (typically less than 2 percent of the operat- 
ing current). Suspend mode is entered either by 
a hardware or software initiated action. Using 
the hardware to initiate suspend mode involves a 
two-pin handshake using the SUSP# and SUSPA# 
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1 .5 Signal Summary 

The Cx486SLC includes two power management signals (SUSP# and SUSPA#), four cache interface 
signals (FLUSH#, KEN#, RPLSET, and RPLVAL#), and an A20 mask input (A20M#) that are additions 
to the 386SX signal set. The complete list of Cx486SLC signals is shown in Figure 1-1. 
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Figure 1 - 1 • Cx486SLC Input and Output Signals 
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2. PROGRAMMING 

INTERFACE 

In this chapter, the internal operations of the 
Cx486SLC are described mainly from an applica- 
" tion programmer's point of view. Included in this 
chapter are descriptions of processor initializa- 
tion, the register set, memory addressing, various 
types of interrupts and the shutdown and halt 
process. Also included is an overview of real, 
virtual 8086, and protected operating modes. 

2.1 Processor 

Initialization 

The Cx486SLC is initialized when the RESET 
signal is asserted. The processor is placed in real 
mode and the registers listed in Table 2-1 are set 
to their initialized values. RESET invalidates and 
disables the Cx486SLC cache, and turns off 



paging. When RESET is asserted, the Cx486SLC 
terminates all local bus activity and all internal 
execution. During the entire time that RESET is 
asserted, the internal pipeline is flushed and no 
instruction execution or bus activity occurs. 

Approximately 350 to 450 CLK2 clock cycles 
(additional 2^° + 60 if self-test is requested) after 
deassertion of RESET, the processor begins 
executing instructions at the top of physical 
memory (address location FF FFFOh). When the 
first intersegment JUMP or CALL is executed, 
address lines A23-A20 are driven low for code 
segment-relative memory access cycles. While 
A23-A20 are low, the Cx486SLC will execute 
instructions only in the lowest 1MByte of physical 
address space until system-specific initialization 
occurs via program execution. 
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Processor Initialization 



Table 2- 1 • Initialized Register Contents 



register 


register name 


initialized contents 


comments 


EAX 


Accumulator 


xxxxxxxxh 


0000 OOOOh indicates self-test 
passed. 


EBX 


Base 


xxxx xxxxh 




ECX 


Count 


xxxxxxxxh 




EDX 


Data 


xxxx 0400 + Revision ID 


Revision ID = lOh. 


EBP 


Base Pointer 


xxxxxxxxh 




ESI 


Source Index 


xxxx xxxxh 




EDI 


Destination Index 


xxxxxxxxh 




ESP 


Stack Pointer 


xxxx xxxxh 




EFLAGS 


Flag Word 


0000 0002h 




EIP 


Instruction Pointer 


0000 FFFOh 




ES 


Extra Segment 


OOOOh 


Base address set to 0000 OOOOh. 
Limit set to FFFbh. 


CS 


Code Segment 


FOOOh 


Base address set to 0000 OOOOh. 
Limit set to FFFhh. 


SS 


Stack Segment 


OOOOh 




DS 


Data Segment 


OOOOh 


Base address set to 0000 OOOOh. 
Limit set to FFFFh. 


FS 


Extra Segment 


OOOOh 




GS 


Extra Segment 


OOOOh 




IDTR 


Interrupt Descriptor Table 
Register 


Base = 0, Limit = 3FFh 




CRO 


Machine Status Word 


6000 OOlOh 




CCRO 


Configuration Control 


OOh 




CCRl 


Configuration Control 1 


xxxx xxxO (binary) 




NCRl 


Non-Cacheable Region 1 


OOOFh 


4 GByte non-cacheable region. 


NCR2 


Non-Cacheable Region 2 


OOOOh 




NCR3 


Non-Cacheable Region 3 


OOOOh 




NCR4 


Non-Cacheable Region 4 


OOOOh 




DR7 


Debug Register DR7 


0000 OOOOh 





Note: X = Undefined value 
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2.2 



Instruction Set Overview 



The Cx486SLC instruction set can be divided into 
eight types of operations: 

Arithmetic 

Bit Manipulation 

Control Transfer 

Data Transfer 

High-Level Language Support 

Operating System Support 

Shift/Rotate 

String Manipulation 

All Cx486SLC instructions operate on as few as 
operands and as many as 3 operands. A NOP 
instruction (no operation) is an example of a 
operand instruction. Two operand instructions 
allow the specification of an explicit source and 
destination pair as part of the instruction. These 
two operand instructions can be divided into 
eight groups according to operand types: 

Register to Register 
Register to Memory 
Memory to Register 
Memory to Memory 
Register to I/O 
I/O to Register 
Immediate Data to Register 
Immediate Data to Memory 

An operand can be held in the instruction itself 
(as in the case of an immediate operand), in a 
register, or in an I/O port or in memory. An 
immediate operand is prefetched as part of the 
opcode for the instruction. 

Operand lengths of 8, 16, or 32 bits are sup- 
ported. Operand lengths of 8 or 32 bits are 
generally used when executing code written for 



386- or486-class (32-bit code) processors. 
Operand lengths of 8 or 16 bits are generally 
used when executing existing 8086 or 80286 code 
(16-bit code). The default length of an operand 
can be overridden by placing one or more 
instruction prefixes in front of the opcode. For 
example, by using prefixes, a 32-bit operand can 
be used with 16-bit code or a 16-bit operand can 
be used with 32-bit code. 

Chapter 6 of this manual lists each instruction in 
the Cx486SLC instruction set along v^th the 
associated opcodes, execution clock counts and 
effects on the FLAGS register. 

2.2o1 Locis Prefix 

The LOCK prefix may be placed before certain 
instructions that read, modify, then vmte back to 
memory. The prefix asserts the LOCK# signal to 
indicate to the external hardware that the CPU is 
in the process of running multiple indivisible 
memory accesses. The LOCK prefix can be used 
v^th the following instructions: 

Bit Test Instructions (BTS, BTR, BTC) 
Exchange Instructions (XADD, XCHG, 

CMPXCHG) 
One-operand Arithmetic and Logical 

Instructions (DEC, INC, NEC, NOT) 
Two-operand Arithmetic and Logical 

Instructions (ADC, ADD, AND, OR, SBB, 

SUB, XOR). 

An invalid opcode exception is generated if the 
LOCK prefix is used with any other instruction, 
or with the above instructions when no write 
operation to memory occurs (i. e., the destination 
is a register). 
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Register Set 



There are 43 accessible registers in the Cx486SLC 
and these registers are grouped into two sets. 
The application register set contains the registers 
frequently used by application programmers, and the 
system register set contains the registers typically 
reserved for use by operating systems programmers. 

The application register set is made up of: 

Eight 32-bit general purpose registers. 

Six 16-bit segment registers. 

One 32-bit flag register. 

One 32-bit instruction pointer register. 

The system register set is made up of the remain- 
ing registers which include: 

Three 32-bit control registers. 

Two 48-bit and two 16-bit system address 

registers. 
Six 32-bit debug registers. 
Two 8-bit and four 16-bit configuration 

registers. 
Five 32-bit test registers. 

Each of the registers is discussed in detail in the 
following sections. 

2.3.1 Application Register Set 

The application register set (Figure 2-1) consists 
of the registers most often used by the applica- 
tions programmer. These registers are generally 
accessible and are not protected from read or 
write access. 

The General Purpose Registers contents are 
frequently modified by assembly language 
instructions and typically contain arithmetic and 
logical instruction operands. 



The Segment Registers contain segment selec- 
tors, which index into tables located in memory. 
These tables hold the base address for each 
segment, as well as other information related to 
memory addressing. 

The Flag Register contains control bits used to 
reflect the status of previously executed instruc- 
tions. This register also contains control bits that 
effect the operation of some instructions. 

The Instruction Pointer is a 32-bit register that 
poiQts to the next instruction that the processor will 
execute. This register is automatically incremented 
by the processor as execution progresses. 

2.3. 1 • 1 General PuiiMse 
Registers 

The general purpose registers are divided into 
four data registers, two pointer registers, and two 
index registers as shown in Figure 2-2. 

Data Registers 

The data registers are used by the applications 
programmer to manipulate data structures and to 
hold the results of logical and arithmetic opera- 
tions. Different portions of the general data 
registers can be addressed by using different 
names. An "E" prefix identifies the complete 32- 
bit register. An "X" suffix without the "E" prefix 
identifies the lower 16 bits of the register. The 
lower two bytes of the register can be addressed 
v^th an "H" suffix to identify the upper byte or an 
"L" suffix to identify the lower byte. When a 
source operand value specified by an instruction 
is smaller than the specified destination register, 
the upper bytes of the destination register are not 
affected when the operand is written to the register. 
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Figure 2-1. Appiiceation Register Set 



Pointer and Index Registers 

The pointer and index registers are listed below: 



BP or EBP 


Base Pointer 


SI or ESI 


Source Index 


DI or EDI 


Destination Index 


SP or ESP 


Stack Pointer 



These registers can be addressed as 16- or 32-bit 
registers, with the "E" prefix indicating 32 bits. 
These registers can be used as general purpose 



registers, however, some instructions use a fixed 
assignment of these registers. For example, the 
string operations always use ESI as the source 
pointer, EDI as the destination pointer, and ECX 
as a counter. The instructions using fixed regis- 
ters include double-precision multiply and 
divide, L^O access, string operations, translate, 
loop, variable shift and rotate, and stack opera- 
tions. 

The Cx486SLC processor implements a stack 
using the ESP register. This stack is accessed 
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during the PUSH and POP instructions, proce- 
dure calls, procedure returns, interrupts, excep- 
tions, and interrupt/exception returns. The 
microprocessor automatically adjusts the value of 
the ESP during operation of these instructions. 



The EBP register may be used to reference data 
passed on the stack during procedure calls. Local 
data may also be placed on the stack and referenced 
relative to BP. This register provides a mecha- 
nism to access stack data in high-level languages. 
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Figure 2-2. General Purpose Registers 
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2.3. 1.2 Segment Registers and 
Selectors 

Segmentation provides a means of defining data 
structures inside the memory space of the micro- 
processor. There are three basic types of seg- 
ments: code, data, and stack. Segments are used 
automatically by the processor to determine the 
location in memory of code, data, and stack 
references. 

There are six 16-bit segment registers: 



cs 


Code Segment 


DS 


Data Segment 


ES 


Extra Segment 


ss 


Stack Segment 


FS 


Additional Data Segment 


GS 


Additional Data Segment 



In real and virtual 8086 operating modes, a 
segment register holds a 16-bit segment base. 
The 16-bit segment base is multiplied by 16 and a 
16-bit or 32-bit offset is then added to it to create 
a linear 'address. The offset size is dependent on 
the current address size. In real mode and in 
virtual 8086 mode with paging disabled, the 
linear address is also the physical address. In 
virtual 8086 mode v^th paging enabled, the 



linear address is translated to the physical address 
using the current page tables. 

In protected mode, a segment register holds a 
segment selector containing a 13-bit index, a table 
indicator (TI) bit, and a two-bit requested privi- 
lege level (RPL) field as shown in Figure 2-3. 

The Index points into a descriptor table in 
memory and selects one of 8192 (2^^) segment 
descriptors contained in the descriptor table. A 
segment descriptor is an eight-byte value used to 
describe a memory segment by defining the 
segment base, the segment limit, and access 
control information. To address data within a 
segment, a 16-bit or 32-bit offset is added to the 
segment's base address. Once a segment selector 
has been loaded into a segment register, an ' 
instruction needs to specify the offset only. 

The Table Indicator (TI) bit of the selector, 
defines which descriptor table the index points 
into. If TI=0, the index references the Global 
Descriptor Table (GDT). If TI=1, the index 
references the Local Descriptor Table (LDT). The 
GDT and LDT are described in more detail later 
in this chapter. 





15 




3 
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INDEX 
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TI= Table Indicator 

RPL = Requested Privilege Level 
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Figure 2-3. Segment Selector 
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The Requested Privilege Level (RPL) field 
contains a 2-bit segment privilege level (O0=most 
privileged, 11= least privileged). The RPL bits are 
used when the segment register is loaded to 
determine the effective privilege level (EPL). If 
the RPL bits indicate less privilege than the 
program, the RPL overrides the current privilege 
level and the EPL is the lower privilege level. If 
the RPL bits indicate more privilege than the 
program, the current privilege level overrides the 
RPL and again the EPL is the lower privilege level. 

When a segment register is loaded with a seg- 
ment selector, the segment base, segment limit 
and access rights are also loaded from the de- 
scriptor table into a user-invisible or hidden 
portion of the segment register, i.e., cached on- 
chip. The CPU does not access the descriptor 



table again until another segment register load 
occurs. If the descriptor tables are modified in 
memory, the segment registers must be reloaded 
with the new selector values. 

The processor automatically selects a default 
segment register for memory references. Table 2-2 
describes the selection rules. In general, data 
references use the selector contained in the DS 
register, stack references use the SS register and 
instruction fetches use the CS register. While 
some of these selections may be overridden, 
instruction fetches, stack operations, and the 
destination write of string operations cannot be 
overridden. Special segment override prefixes allow 
the use of alternate segment registers including 
the use of the ES, FS, and GS segment registers. 



Table 2-2. Segment Register Selection Rules 



TYPE OF MEMORY REFERENCE 


IMPLIED (DEFAULT) 
SEGMENT 


SEGMENT OVERRIDE PREFIX 


Code Fetch 


CS 


None 


Destination of PUSH, PUSHF, INT, CALL, 
. PUSHA instructions 


SS 


None 


Source of POP, POPA, POPF, IRET, 
RET instuctions 


SS 


None. 


Destination of STOS, MOVS, REP 
STOS, REP MOVS instructions 


ES 


None 


Other data references with effective 
address using base regesters of: 
FAX, EBX, ECX, 
EDX, ESI, EDI 

EBP,ESP 


DS 

SS 


CS, ES, FS, GS, SS 
CS, DS, ES, FS, GS 
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2.3. 1.3 Instruction Pointer 
Register 

The Instruction Pointer (EIP) register contains the 
offset into the current code segment of the next 
instruction to be executed. The register is nor- 
mally incremented with each instruction execu- 
tion unless implicitly modified through an inter- 
rupt, exception or an instruction that changes the 
sequential execution flow (e.g., jump, call ). 



2.3.1.4 Flags Register 

The Flags Register, EFLAGS, contains status 
information and controls certain operations on 
the Cx486SLC microprocessor. The lower 16 bits 
of this register are referred to as the FLAGS 
register that is used when executing 8086 or 
80286 code. The flag bits are shown in 
Figure 2-4 and defined in Table 2-3. 



FLAGS 



2 2 
4 3 



H- 



1 1 1 1 M 1 1 1 1 
987654321 



1 
9 



7 6 5 4 3 2 10 



0000000000000 



-h 



U" 



lO 
PL 



ALIGNMENT CHECK — S 

VIRTUAL 8086 MODE — S 

RESUME FLAG — D 

NESTED TASK FLAG — S 

VO PRIVILEGE LEVEL — S 

OVERFLOW — A 

DIRECTION FLAG — C 

INTERRUPT ENABLE — S 

TRAP FLAG — D 

SIGN FLAG — A 

ZERO FLAG — A 

AUXILL\RY CARRY — S 

PARITY FLAG — A 

CARRY FLAG — A 



A = ARITHMETIC FLAG, D = DEBUG FLAG, S = SYSTEM FLAG, C = CONTROL FLAG 
OR 1 INDICATES RESERVED 



Figure 2-4. EFLAGS Register 
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Table 2-3. EFLAGS Bit Definitions 



BIT 
POSITION 


NAME 


FUNCTION 





CF 


Carry Flag: Set when a carry (additon) or borrow (subtraction) out of or into the most 
significant bit of the result occurs; cleared otherwise 


2 


PF 


Parity Flag: Set when the low-order 8 bits of the result contain an even number of ones; 
cleared otherwise. 


4 


AF 


Auxiliary Carry Flag: Set when a carry (addition) or borrow (subtraction) out of or into 
bit position 3 of the result occurs; cleared otherwise. 


6 


ZF 


Zero Flag: Set if result is zero; cleared otherwise. 


7 


SF 


Sign Flag: Set equal to high-order bit of result (0 indicates positive, 1 indicates negative). 


8 


TF 


Trap Enable Flag: Once set, a single-step interrupt occurs after the next instruction 
completes execution. TF is cleared by the single-step interrupt. 


9 


IF 


Interrupt Enable Flag: When set, maskable interrupts (INTR input pin) are acknowl- 
edged and serviced by the CPU. 


10 


DF 


Direction Flag: When cleared, DF causes string instructions to auto-increment (default) 
the appropriate index registers (ESI and/or EDI). Setting DF causes auto-decrement of the 
index registers to occur. 


11 


OF 


Overflow Flag: Set if the operation resulted in a carry or borrow into the sign bit of the 
result but did not result in a carry or borrow out of the high-order bit. Also set if the 
operation resulted in a carry or borrow out of the high-order bit but did not result in a 
carry or borrow into the sign bit of the result. 


12,13 


lOPL 


I/O Privilege Level: While executing in protected mode, lOPL indicates the maximum 
current privilege level (CPL) permitted to execute I/O instructions without generating an 
exception 13 fault or consulting the I/O permission bit map. lOPL also indicates the 
maximum CPL allowing alteration of the IF bit when new values are popped into the 
EFLAGS register. 


14 


NT 


Nested Task: While executing in protected mode, NT indicates that the execution of the 
current task is nested within another task. 


16 


RF 


Resume Flag: Used in conjunction with debug register breakpoints. RF is checked at 
instruction boundaries before breakpoint exception processing. If set, any debug fault is 
ignored on the next instruction. 


17 


VM 


Virtual 8086 Mode: If set while in protected mode, the microprocessor switches to 
virtual 8086 operation handling segment loads as the 8086 does, but generating excep- 
tion 13 faults on privileged opcodes. The VM bit can be set by the IRET instriiction (if 
current privilege level=0) or by task switches at any privilege level. 


18 


AC 


Alignment Check Enable: In conjunction with the AM flag in CRO, the AC flag deter- 
mines whether or not misaligned accesses to memory cause a fault. If AC is set, align- 
ment faults are enabled. 
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2.3.2 System Register Set 

The system register set (Figure 2-5) consists of 
registers not generally used by application pro- 
grammers. These registers are typically employed 
by system level programmers who generate 
operating systems and memory management 
programs. 

The Control Registers control certain aspects of 
the Cx486SLC microprocessor such as paging, 
coprocessor functions, and segment protection. 
When a paging exception occurs while paging is 
enabled, the control registers retain the linear 
address of the access that caused the exception. 

The Descriptor Table Registers and the Task 

Register can also be referred to as system address 
or memory management registers. These regis- 
ters consist of two 48-bit and two 16-bit registers. 
These registers specify the location of the data 
structures that control the segmentation used by 
the Cx486SLC microprocessor. Segmentation is 
one available method of memory management. 



The Configuration Registers are used to control 
the Cx486SLC on-chip cache operation and 
power management features. The cache and 
power management features can be enabled or 
disabled by writing to these registers. Non- 
cacheable areas of physical memory are also 
defined through the use of these registers. 

The Debug Registers provide debugging facili- 
ties for the Cx486SLC microprocessor and enable 
the use of data access breakpoints and code 
execution breakpoints. 

The Test Registers provide a mechanism to test 
the contents of both the on-chip 1 KByte cache 
and the translation lookaside buffer (TLB). The 
TLB is used as a cache for translating linear 
addresses to physical addresses when paging is 
enabled. In the following sections, the system 
register set is described in greater detail. 
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1615 



Page Fault Linear Address Register 



Page Directory Base Register 



47 
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Base 


Limit 


Base 


Limit 








Selector 




Selector 
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Linear Breakpoint Address 


Linear Breakpoint Address 1 


Linear Breakpoint Address 2 


Linear Breakpoint Address 3 


Breakpoint Status 


Breakpoint Control 





7 




CCRO 


15 


CCRl 


Non-Cacheable Region 1 


Non-Cacheable Region 2 


Non-Cacheable Region 3 


Non-Cacheable Region 4 
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Cache Test 



Cache Test 



Cache Test 



Test Control 



Test Status 



CRO 
CR2 
CR3 _ 


Control 
Registers 


GDTR "" 
IDTR 


Descripter 
Table 


LDTR _ 


Registers 


TR 


Task Register 


DRO 




DRl 
DR2 
DR3 


Debug 
Registers 


DR6 




DR7 




CCRO 




CCRl 




NCRl 


Configuration 


NCR2 


Registers 


NCR3 




NCR4 




TR3 




TR4 
TR5 
TR6 


Test 
Registers 


TR7 





CCRO = Configuration Control 
CCRl = Configuration Control L 



Figure 2-5. System Register Set 
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2.3.2.1 Control Registers 

The control registers, CRO through CR3, are 
shown in Figure 2-6. The CRO register contains 
system control flags which control operating 
modes and indicate the general state of the CPU. 
The lower 16 bits of CRO are referred to as the 
machine status word (MSW). The CRO bit 
definitions are described in Table 2-4. The 
reserved bits in the CRO should not be modified. 

When paging is enabled and a page fault is 
generated, the CR2 register retains the 32-bit 



linear address of the address that caused the fault. 
CR3 contains the 20-bit base address of the page 
directory. The page directory must always be 
aligned to a 4 KByte page boundary, therefore, 
the lower 12 bits of CR3 should always be equal 
to zero. 

When operating in protected mode, any program 
can read the control registers. However, only 
privilege level (most privileged) programs can 
modify the contents of these registers. 
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12 11 



PAGE DIRECTORY BASE REGISTER (PDBR) 




PAGE FAULT LINEAR ADDRESS 




3 2 10/ 



CR3 



CR2 



CRO 



Figure 2-6. Control Registers 
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Table 2-4. CRO Bit Definitions 



BIT 
POSITION 


NAME 


FUNCTION 





PE 


Protected Mode Enable: Enables the segment based protection mechanism. If PE=1, 
protected mode is enabled. If PE=0, the CPU operates in real mode, with segment based 
protection disabled, and addresses are formed as in an 8086-class CPU. 


1 


MP 


Monitor Processor Extension: If MP=1 and TS=1, a WAIT instruction causes fault 7. The 
TS bit is set to 1 on task switches by the CPU. Floating point instructions are not affected 
by the state of the MP bit. The MP bit should be set to one during normal operations. 


2 


EM 


Emulate Processor Extension: If EM=1, all floating point instructions cause a fault 7. 


3 


TS 


Task Switched: Set whenever a task switch operation is performed. Execution of a 
floating point instruction with TS=1 causes a device not available (DNA) fauk. If MP=1 
and TS=1, a WAIT instruction also causes a DNA fault. 


4 


1 


Reserved: Do not attempt to modify. 


5 





Reserved: Do not attempt to modify. 


16 


WP 


Write Protect: Protects read-only pages from supervisor write access. The 386-type CPU 
allows a read-only page to be written from privilege level 0-2. The Cx486SLC CPU is 
compatible with the 386-type CPU when WP=0. WP=1 forces a fault on a write to a 
read-only page from any privilege level. 


18 


AM 


Alignment Check Mask: If AM=1, the AC bit in the EFLAGS register is unmasked and 
allowed to enable alignment check faults. Setting AM=0 prevents AC faults from occur- 
ring. 


29 





Reserved: Do not attempt to modify. 


30 


CD 


Cache Disable: If CD=1, no further cache fills occur. However, data already present in 
the cache continues to be used if the requested address hits in the cache. The cache must 
also be invalidated to completely disable any cache activity. 


31 


PG 


Paging Enable Bit: If PG=1 and protected mode is enabled (PE=1), paging is enabled. 
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2.3.2.2 Descriptor Table 

Registers and Descriptors 

Descriptor Table Registers 

The Global, Interrupt and Local Descriptor Table 
Registers (GDTR, IDTR and LDTR), shown in 
Figure 2-7, are used to specify the location of the 
data structures that control segmented memory 



management. The GDTR, IDTR and LDTR are 
loaded using the LGDT, LIDT and LLDT instruc- 
tions, respectively. The values of these registers 
are stored using the corresponding store instruc- 
tions. The GDTR and IDTR load instructions are 
privileged instructions when operating in pro- 
tected mode. The LDTR can only be accessed in 
protected mode. 





48 




16 15 





GDTR 

IDTR 

LDTR 




BASE ADDRESS 


LIMIT 


BASE ADDRESS 


LIMIT 




1708000 






SELECTOR 



Plgure 2-7. Descriptor Table Registers 



The Global Descriptor Table Register (GDTR) 
holds a 32-bit base address and 16-bit limit for 
the Global Descriptor Table (GDT). The GDT is 
an array of up to 8192 8-byte descriptors. When 
a segment register is loaded from memory, the TI 
bit in the segment selector chooses either the 
GDT or the local descriptor table (LDT) to locate 
a descriptor. The index portion of the selector is 
used to locate a given descriptor within the 
descriptor table. The contents of the GDTR are 
completely visible to the programmer. The first 
descriptor in the GDT (location 0) is not used by 
the CPU and is referred to as the "null descrip- 
tor". If the GDTR is loaded while operating in 16- 
bit operand mode, the Cx486SLC accesses a 32- 
bit base value but the upper 8 bits are ignored 
resulting in a 24-bit base address. 



The Interrupt Descriptor Table Register 

(IDTR) holds a 32-bit base address and 16-bit 
limit for the Interrupt Descriptor Table (IDT). 
The IDT is an array of 256 8-byte interrupt 
descriptors, each of which is used to point to an 
interrupt service routine. Every interrupt that 
may occur in the system must have an associated 
entry in the IDT. The contents of the IDTR are 
completely visible to the programmer. 

The Local Descriptor Table Register (LDTR) 
holds a 16-bit selector for the Local Descriptor 
Table (LDT). The LDT is an array of up to 8192 
8-byte descriptors. When the LDTR is loaded, 
the LDTR selector field indexes an LDT descrip- 
tor that must reside in the global descriptor table 
(GDT). The contents of the selected descriptor 
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are cached on-chip in the hidden portion of the 
LDTR. The CPU does not access the GDT again 
until the LDTR is reloaded. If the LDT descrip- 
tion is modified in memory in the GDT, the 
LDTR must be reloaded to update the hidden 
portion of the LDTR. 

When a segment register is loaded from memory, 
the TI bit in the segment selector chooses either 
the GDT or the LDT to locate a segment descrip- 
tor. If Tl = 1 , the index portion of the selector is 
used to locate a given descriptor within the LDT. 
Each task in the system may be given its own 
LDT, managed by the operating system. The 
LDTs provide a method of isolating a given task's 
segments from other tasks in the system. 



Descriptors 

Descriptors are divided into three types. Appli- 
cation Segment Descriptors are used to define 
code, data and stack segments. System Segment 
Descriptors define an LDT segment or a TSS. 
Gate Descriptors define task gates, interrupt 
gates, trap gates and call gates. 

Application Segment Descriptors can be located 
in either the LDT or GDT. System Segment 
Descriptors can only be located in the GDT. 
Dependent on the gate type, gate descriptors may 
be located in either the GDT, LDT or IDT. Figure 
2-8 illustrates the descriptor format for both 
Application Segment Descriptors and System 
Segment Descriptors and Table 2-5 lists the 
corresponding bit definitions. 
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Figure 2-8. Application and System Segment Descriptors 



2-16 



PRELIMINARY 



Register Set 



Table 2-5. Segment Descriptor Bit Definitions 



BIT 


MEMORY 


NAME 


DESCRIPTION 


POSITION 


OFFSET 






31-24 


+4 


BASE 


Segment base address. 


7-0 


+4 




32-bit linear address that points to the beginning of the segment. 


31-16 


+0 






19-16 


+4 


LIMIT 


Segment limit. In real mode, segment limit is always 64 KBytes 


15-0 


+0 




(OFFFFh). 


23 


+4 


G 


Limit granularity bit: 

= byte granulairty, 1=4 KBytes (page) granularity. 


22 


+4 


D 


Default length for operands and effective addresses. 

Valid for code and stack segments only: 0=16 bit, 1 = 32-bit. 


20 


+4 


AVL 


Segment available. 


15 


+4 


P 


Segment present. 


14-13 


+4 


DPL 


Descriptor privilege level. 


12 


+4 


DT 


Descriptor type: 

= system, 1 = application. 


11-8 


+4 


TYPE 


Segment type. 

System descriptor (DT = 0): 
0010 = LDT descriptor. 
1001 = TSS descriptor, task not busy. 
1011 = TSS descriptor, task busy. 

Application descriptor (DT =1): 


11 




E 


= data, 1 = executable. 


10 




C/D 


If E = 0: 

= expand up, limit is upper bound of segment. 

1 = expand down, limit is lower bound of segment. 
If E = l: 

= non-conforming. 

1 = conforming (runs at privilege level of calling procedure). 


9 




RAV 


If E = 0: 

= non-readable. 

1 = readable. 
IfE=l: 

= non- writable. 

1 = writable. 


8 




A 


= not accessed, 1 = accessed. 
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Gate Descriptors provide protection for execut- 
able segments operating at different privilege 
levels. Figure 2-9 illustrates the format for Gate 
Descriptors and Table 2-6 lists the corresponding 
bit definitions. 

Task Gate descriptors are used to switch the 
CPU's context during a task switch. The selector 
portion of the Task Gate descriptor locates a Task 
State Segment. Task Gate descriptors can be 
located in the GDT, LDT or IDT. 



Interrupt Gate descriptors are used to enter a 
hardware interrupt service routine. Trap Gate 
descriptors are used to enter exceptions or 
software interrupt service routines. Trap Gate 
and Interrupt Gate descriptors can only be 
located in the IDT. 

Call Gate descriptors are used to enter a proce- 
dure (subroutine) that executes at the same or a 
more privileged level. A Call Gate descriptor 
primarily defines the procedure entry point and 
the procedure's privilege level. 
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Figure 2-9. Gate Descriptor 
Table 2-6. Gate Descriptor Bit Definitions 



BIT 


MEMORY 


NAME 


DESCRIPTION 


POSITION 


OFFSET 






31-16 


+4 


OFFSET ' 


Offset used during a call gate to calculate the branch target. 


15-0 


+0 






31-16 


+0 


SELECTOR 


Segment selector used during a call gate to calculate the branch target. 


15 


+4 


P 


Segment present. 


14-13 


+4 


DPL 


Descriptor privilege level. 


11-8 


+4 


TYPE 


Segment type: 
0100= 16-bit call gate 
0101 = tack gate 

0110 = 16-bit interrupt gate 

0111 = 16-bit trap gate 
1100 = 32-bit call gate 
1110 = 32-bit interrupt gate 
nil = 32-bit trap gate 


4-0 


-^4 


Parameters 


Number of 32-bit parameters to copy from the caller's stack to the called 
procedure's stack. 
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2.3e2.3 Task Register 

The Task Register (TR) holds a 16-bit selector 
for the current Task State Segment (TSS) table 
as shown in Figure 2-10. The TR is loaded and 



stored via the LTR and STR instructions, respec- 
tively. The TR can only be accessed during 
protected mode and can only be loaded when the 
privilege level is (most privileged). 




Figure 2- 1 0. Task Register 
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When the TR is loaded, the TR selector field 
indexes a TSS descriptor that must reside in the 
global descriptor table (GDT). The contents of 
the selected descriptor are cached on-chip in the 
hidden portion of the TR. 



new task. The TR points to the current TSS. The 
TSS can be either a 286-type 16-bit TSS or a 386/ 
486-type 32-bit TSS as shown in Figures 2-llA 
and 2-1 IB. An I/O permission bit map is referenced 
in the 32-bit TSS by the I/O Map Base Address. 



During task switching, the processor saves the 
current CPU state in the TSS before starting a 
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I/O MAP BASE ADDRESS 


000000000 00 000 OJT 


+64h 

+60h 

+5Ch 
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+54h 
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+4Ch 
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+2Ch 
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+24h 

+20h 

+lCh 

+18h 
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+Ch 
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+0h 


0000000000000000 


SELECTOR FOR TASK'S LDT 


0000000000000000 
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0000000000000000 


FS 
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0000000000000000 
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Figure 2-1 1 A. 32-Bit Tasic State Segment (TSS) Table 
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SFT FCTOR FOR TASK'S LDT 
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Figure 2- 1 1 B. 1 6-Bit Task State Segment (TSS) Table 
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2.3.2.4 Configuration Registers 

The Cx486SLC provides six internal registers 
used to configure the internal cache and to 
enable or disable cache control and power 
management pins. These registers do not exist 
on any 80X86 microprocessors. Four of the 
registers are dedicated to defining non-cacheable 
areas of memory and the remaining two registers 
are used for Cx486SLC cache control and power 
management control as shown in Table 2-7. 

Access to the Configuration Registers is achieved 
by writing the address (referred to as the index) 



of the register to I/O port 22h. I/O port 23h is 
then accessed to read or write data from or to the 
configuration register. Accesses to the on-chip 
configuration registers do not generate external I/O 
bus cycles. However, each I/O port 23h opera- 
tion must be preceded by an I/O port 22h opera- 
tion, otherwise the second and later I/O port 23h 
operations are directed off-chip and produce 
extemal I/O bus cycles. Accesses to I/O port 22h 
with an index outside of the CO-CFh range also 
result in extemal I/O cycles and do not effect the 
on-chip configuration registers. 



Table 2-7. Configuration Registers Index Assignments 



REGISTER NAME 


REGISTER IKDEX 


NUMBER OF BITS IN REGISTER 


CCRO 

Configuration Control 


COh 


8 


CCRl 

Configuration Control 1 


Clh 


8 


Reserved 


C2h - C4h 


24 


NCRl 

Non-Cacheable Region 1 


C5h - C6h 


16 


Reserved 


C7h 


8 


NCR2 

Non-Cacheable Region 2 


C8h - C9h 


16 


Reserved 


CAh 


8 


NCR3 

Non-Cacheable Region 3 


CBh - CCh 


16 


Reserved 


CDh 


8 


NCR4 

Non-Cacheable Region 4 


CEh - CFh 


16 
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Bit assignments for the configuration registers are 
listed in Table 2-8. The non-cacheable regions 
are defined by a starting address and a block size. 
The non-cacheable region block size ranges from 
4 KByte to 4 GByte as shown in Table 2-8A. The 
starting address of the non-cacheable region is 
restricted to block size boundary alignment. For 
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example, a 128 KByte non-cacheable block is 
allowed to have a starting address of KB, 128 
KB, 256 KB, etc. This relationship between block 
size and starting address is true for all block sizes 
except 4 GBytes. When the block size is set to 4 
GBytes, all physical memory is non-cacheable 
regardless of the setting of the starting address. 



Table 2-8. Configuration Registers Bit Assignments 



REGISTER 
NAME 


REGISTER 
INDEX 


BITS 


DESCRIPTION 


Configuration Control 
(CCRO) 


COh 




1 
2 
3 
4 
5 

6 
7 


NCO: If = 1, sets the first 64 KBytes at each 1 MByte boundary as 

non-cacheable, when operating in real or virtual 8086 mode. 

NCI: If = 1, sets 640 KBytes to 1 MByte region as non-cacheable. 

A20M: If = 1, enables A20M# input pin. 

KEN: If = 1 , enables KEN# input pin. 

FLUSH: If = 1, enables FLUSH# input pin. 

BARB: If =1, enables flushing of internal cache when hold state is 

entered. 

CO: Selects cache organization: 

= 2-way set associative 

1 = direct-mapped 

SUSPEND: If = 1, enables SUSP# input and SUSPA# output pins. 
If = 0, output SUSPA# floats. 


Configuration Control 
(CCRl) 


Clh 



7-1 


RPL: If = 1, enables output pins RPLSET and RPLVAL#. 
If = outputs RPLSET and RPLVAL# float. 
Reserved. 


Non-Cacheable 
Region 1 


C5h 


7-0 


Address bits A23 - A16 of Region 1 starting address. 


C6h 


7-4 


Address bits A15 - A12 of Region 1 starting address. 


3-0 


Region 1 Block Size (Table 2-8A). 


Non-Cacheable 
Region 2 


C8h 


7-0 


Address bits A23 - A16 of Region 2 starting address. 


C9h 


7-4 


Address bits A15 - A12 of Region 2 starting address. 


3-0 


Region 2 Block Size (Table 2-8A). 


Non-Cacheable 
Region 3 


CBh 


7-0 


Address bits A23 - A16 of Region 3 starting address. 


CCh 


7-4 


Address bits A15 - A12 of Region 3 starting address. 


3-0 


Region 3 Block Size (Table 2-8A). 


Non-Cacheable 
Region 4 


CEh 


7-0 


Address bits A23 - A16 of Region 4 starting address. 


CFh 


7-4 


Address bits A15 - A12 of Region 4 starting address. 


3-0 


Region 4 Block Size (Table 2-8A). 



Note: All bits are cleared to at reset, except C6h. C6h defaults to OFh to set the first non-cacheable region size = 4 GBytes. 
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Table 2-8A. Non-Gacheable Regions Biocic Size Field 



BITS 3-0 


BLOCK SIZE 


BITS 3-0 


BLOCK SIZE 


Oh 


Disabled 


8h 


512 KBytes 


Ih 


4 KBytes 


9h 


1 MBytes 


2h 


8 KBytes 


Ah 


2 MBytes 


3h 


16 KBytes 


Bh 


4 MBytes 


4h 


32 KBytes 


Ch 


8 MBytes 


5h 


64 KBytes 


Dh 


16 MBytes 


6h 


128 KBytes 


Eh 


32 MBytes 


7h 


256 KBytes 


Fh 


4 GBytes 



2.3.2«5 Debug Registers 

Six debug registers (DR0-DR3, DR6 and DR7), 
shown in Figure 2-12, support debugging on the 
Cx486SLC. Memory addresses loaded in the 
debug registers, referred to as "breakpoints", 
generate a debug exception when a memory access 
of the specified type occurs to the specified address. 
A breakpoint can be specified for a particular kind of 



memory access such as a read or a write. Code 
and data breakpoints can also be set allowing 
debug exceptions to occur whenever a given data 
access (read or write) or code access (execute) 
occurs. The size of the debug target can be set to 
l-b)1:e, 2-bytes, or 4-bytes. The debug registers are 
accessed via MOV instructions which can be 
executed only at privilege level 0. 





332222222 22 211111111 1 

109876543 21 098765 432 09876543210 






LEN 
3 


RAV 
3 


LEN 
2 


RAV 

2 


LEN 
1 


RAV 

1 


LEN 



RAV 






G 





G 
E 


L 
E 


G 

3 


L 

3 


G 


L 
2 


G 

1 


L 
1 




L 



DR7 
DR6 
DR5 
DR4 
DR3 
DR2 
DRl 
DRO 


0000000 00 00 00000 


B 

T 


B 


1 


111 1 1 1 11 


B 
3 


B 

2 


B 


B 




RESERVED 


RESERVED 


BREAKPOINT 3 LINEAR ADDRESS 


BREAKPOINT 2 LINEAR ADDRESS 


BREAKPOINT 1 LINEAR ADDRESS 


BREAKPOINT LINEAR ADDRESS 




ALL BITS MARKED AS OR 1 ARE RESERVED AND SHOULD NOT BE MODIFIED. 


703201 
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The debug address registers DRO - DR3 each 
contain the linear address for one of four possible 
breakpoints. Each breakpoint is further specified 
by bits in the debug control register (DR7). For 
each breakpoint address in DR0-DR3, there are 
corresponding fields L, RAV, and LEN in DR7 
that specify the type of memory access associated 
with the breakpoint. The RAV field can be used 
to specify execution as well as data access 
breakpoints. Instruction execution and data access 



breakpoints are always taken before execution of 
the instruction that matches the breakpoint. 

The debug status register (DR6) reflects condi- 
tions that were in effect at the time the debug 
exception occurred. The contents of the DR6 
register are not automatically cleared by the . 
processor after a debug exception occurs and, 
therefore, should be cleared by software at the 
appropriate time. Table 2-8 lists the bit defini- 
tions for the DR6 and DR7 registers. 



Table 2-9o PH^ ciiici BR7 WleM i^eliifiifioiis 



REGISTER 


FIELD 


NUMBER OF BITS 


BEsemp^m^ 


DR7 


RAVi 


2 


Applies to the DRi breakpoint address register: 

00 - Break on instruction execution only. 

01 - Break on data writes only. 

10 - Not used. 

1 1 - Break on data reads or writes. 


LENi 


2 


Applies to the DRi breakpoint address register: 

00 - One byte length. 

01 - Two byte length. 

10 - Not used. 

1 1 - Four byte length. 


Gi 


1 


If set to a 1 , breakpoint in DRi is globally enabled for all tasks 
and is not cleared by the processor as the result of a task switch. 


Li 


1 


If set to a 1, breakpoint in DRi is locally enabled for the current 
task and is cleared by the processor as the result of a task switch. 


GD 


1 


Global disable of debug register access. GD bit is cleared 
whenever a debug exception occurs. 


DR6 


Bi 


1 


Bi is set by the processor if the conditions described by DRi, 
RAVi, and LENi occurred when the debug exception occurred, 
even if the breakpoint is not enabled via the Gi or Li bits. 


BT 


1 


BT is set by the processor before entering the debug handler if a 
task switch has occurred to a task with the T bit in the TSS set. 


BS 


1 


BS is set by the processor if the debug exception was triggered 
by the single -step execution mode (TF flag in EFLAGS set). 
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Code execution breakpoints may also be gener- 
ated by placing the breakpoint instruction (INT 
3) at the location where control is to be regained. 
The single-step feature may be enabled by setting 
the TF flag in the EFLAGS register. This causes 
the processor to perform a debug exception after 
the execution of every instruction. 

2.3.2.6 Test Registers 

The five test registers, shown in Figure 2-13, are 
used in testing the CPU's translation look-aside 
buffer (TLB) and on-chip cache. TR6 and TR7 
are used for TLB testing, and TR3-TR5 and used 
for cache testing. 

TLB Test Registers 

The Cx486SLC TLB is a four-way set associative 
memory with eight entries per set. Each TLB entry 
consists of a 24-bit tag and 20-bit data. The 24-bit tag 
represents the high-order 20 bits of the linear address, 



a valid bit, and three attribute bits. The 20-bit data 
portion represents the upper 20 bits of the physical 
address that corresponds to the linear address. 

TR6 is the TLB Test Command Register. TR6 
contains a command bit, the upper 20 bits of a linear 
address, a valid bit and the attribute bits used in the 
test operation. The contents of TR6 are used to create 
the 24-bit TLB tag during both write and read (TLB 
lookup) test operations. The command bit defines 
whether the test operation is a read or a write. 

TR7 is the TLB Test Data Register. TR7 contains 
the upper 20 bits of the physical address (TLB data 
field), two LRU bits and a control bit. During TLB 
write operations, the physical address in TR7 is 
written into the TLB entry selected by the contents of 
TR6. During TLB lookup operations, the TLB data 
selected by the contents of TR6 is loaded into TR7. 

Tables 2-10 and 2-lOA list the bit definitions for 
the TR6 and TR7 registers. 



















TLB PHYSICAL ADDRESS 


PCD 


PWT 


TLB LRU 





PL 


REP 





TR7 




31 




12 11 10 9 8 7 6 5 


4 3 2 


1 






TLB LINLEAR ADDRESS 


V 


D 


D# 


u 


u# 


w 


w# 








c 


TR6 




31 




12 11 10 9 8 7 6 5 


4 3 2 


1 






^^P 


^P||l>|^^ 


^^^^ 


LINE SELECTION 




SET 


CTL 


TR5 




31 




11 10 9 8 7 6 5 


4 3 2 


1 






CACHE TAG ADDRESS 


^CACHE 
^ILRUI VALI 


D BITS 








TR4 




31 




9 8 7 6 5 


4 3 2 


1 






CACHE DATA 


TR3 


I 


31 
g=Reserved 


- 









701001 



Figure 2- 1 3. Test Registers 
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Table 2-10. TR6 and TR7 Bit Definitions 



REGISTER 
NAME 


BIT 
POSITION 


DESCRIPTION 


TR6 


31-12 


Linear address. 

TLB lookup: The TLB is interrogated per this address. If one and only one match 

occurs in the TLB, the rest of the fields in TR6 and TR7 are updated per the matching 

TLB entry. 

TLB write: A TLB entry is allocated to this linear address. 


11 


Valid bit (V). 

TLB lookup: Always set to 1. 

TLB write: If set, indicates that the TLB entry contains valid data. If clear, target 

entry is invalidated. 


10-9 


Dirty attribute bit and its complement (D, D#). (Refer to Table 2-lOA). 


8-7 


User/supervisor attribute bit and its complement (U, U#). (Refer to Table 2-lOA). 


6-5 


Read/write attribute bit and its complement (R, R#). (Refer to Table 2-lOA). 





Command bit (C). 
If=0: TLB write. 
If=l: TLB lookup. 


TR7 


31-12 


Physical address. 

TLB lookup: data field from the TLB. 

TLB write: data field written into the TLB. 


11 


Page-level cache disable bit (PCD). 
Corresponds to the PCD bit of a page table entry. 


10 


Page-level cache write-through bit (PWT). 
Corresponds to the PWT bit of a page table entry. 


9-7 


LRU bits. 

TLB lookup: LRU bits associated with the TLB entry prior to the TLB lookup. 

TLB write: ignored. 


4 


PL bit. 

TLB lookup: If = 1, read hit occurred. If = 0, read miss occurred. 

TLB write: If = 1, REP field is used to select the set. If = 0, the pseudo-LRU 

replacement algorithm is used to select the set. 


3-2 


Set selection (REP). 

TLB lookup: If PL = 1, set in which the tag was found. If PL = 0, undefined data. 

TLB write: If PL = 1, selects one of the four sets for replacement. If PL=0, ignored. 
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Table2-10A. TR6 AHribute Bit Pairs 



BIT 
(B) 


BIT COMPLEMENT 
(B#) 


EFFECT ON TLB LOOKUP 


EFFECT ON TLB WRITE 








Do not match. 


Undefined. 





1 


Match if the bit is 0. 


Clear the bit. 


1 





Match if the bit is 1. 


Set the bit. 


1 


1 


Match is the bit is 1 or 0. 


Undefined. 



Cache Test Registers 

The Cx486SLC on-chip cache is a two-way set 
associative memory with 128 entries per set. 
Each TLB entry consists of a 23-bit tag, 32-bit 
data, and four valid bits. The 23-bit tag repre- 
sents the high-order 23 bits of the physical 
address. The 32-bit data represents the four bytes 
of data currently in memory at the physical 
address represented by the tag. The four valid 
bits indicate which of the four data bytes actually 
contain valid data. 



The Cx486SLC contains three test registers that 
allow testing of its internal cache. Using these 
registers, cache test writes and reads may be 
performed. Cache test reads allow inspection of 
the data, valid bits and the LRU bit for the cache 
entPf. Cache test writes cause the data in TR3 to 
be written to the selected set and line in the 
cache. For a line allocation to occur, the valid 
bits for the line must be set prior to the write of 
the data. Bit definitions for the cache test regis- 
ters are shown in Table 2-n . 
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Table 2-11. ?il3-TR5 Bit Definitions 



REGISTER 
NAME 


BIT 
POSITION 


DESCRIPTION 


TR3 


31-10 


Cache data. 

Cache read: data accessed from the cache. 

Cache write: to be written into the cache. 


TR4 


31-9 

7 

6-3 


Tag address. 

Cache read: tag address from which data is read. 

Cache write: data written into the tag address of the selected line. 

LRU. 

Cache read: the LRU bit associated with the cache line. 

Cache write: ignored. 

Valid bits. 

Cache reads: four valid bits for the accessed line, (one bit per byte). 

Cache writes: valid bits written into the line. 


TR5 


10-4 
2 

1-0 


Line Se 

Set sele 

lf=0: 

If=l: 

Contro 
If =00 
If =01 
If =10 
If =11 


lection. Selects one of 128 lines. 

xtion. 

set is selected. 

set 1 is selected. 

1 bits. These bits control reading or writing the cache. 
Ignored. 
Cache write. 
Cache read. 
Cache flush (marks all entries as invalid). 
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2.4 Address Spaces 

The Cx486SLC can directly address either 
memory or I/O space. Figure 2-14 illustrates 
the range of addresses available for memory 
address space and I/O address space. For the 
Cx486SLC, the addresses for physical memory 
range between 00 OOOOh and FF FFFFh (16 



MBytes). The accessible I/O addresses space 
ranges between 00 OOOOh and 00 FFFFh (64 
KBytes). The coprocessor communication space 
exists in upper I/O space between 80 00F8h and 
80 OOFFh. These coprocessor I/O ports are 
automatically accessed by the CPU whenever an 
ESC opcode is executed. The I/O locations 22h 
and 23h are used for Cx486SLC configuration 
register access. 



Physical 
Memory Space 



FF FFFFh 



00 OOOOh 



Physical Memory 
16 MBytes 



FF FFFFh 



Accessible 

Programmed 

I/O Space 



80 OOFFh 
80 00F8h 



00 FFFFh 



00 OOOOh 



iiilililiiiiii 

|i||iil|i|cGessiMiiiiiiii:l: 






< 


iiiiiiii 

||i||||&Ges|iiiel|iiii|| 




64 KBytes 






■^ 



Coprocessor 
Space 



486SLC 
Configuration 
Register I/O 
Space 
00 0023h 
00 0022h 



Figure 2- 1 4* Memory and I/O Address Spaces 
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2.4.1 I/O Address Space 

The Cx486SLC I/O address space is accessed 
using IN and OUT instructions to addresses 
referred to as "ports". The accessible I/O address 
space is 64 KBytes and can be accessed as 8-bit, 
16-bit or 32-bit ports. The execution of any IN or 
OUT instruction causes the M/IO# pin to be 
driven low, thereby selecting the I/O space 
instead of memory space for loading or storing 
data. The upper 8 address bits are always driven 
low during IN and OUT instruction port accesses. 

The Cx486SLC configuration registers reside 
within the I/O address space at port addresses 
22h and 23h and are accessed using the standard 
IN and OUT instructions. The configuration 
registers are modified by writing the index of the 
configuration register to port 22h and then 
transferring the data through port 23h. Accesses 
to the on-chip configuration registers do not 
generate external I/O cycles. However, each port 
23h operation must be preceded by a port 22h 
write with a valid index value, otherwise the 
second and later port 23h operations are directed 
off-chip and generate extemal I/O cycles without 
modifying the on-chip confiuration registers. Also, 
writes to port 22h outside of the Cx486SLC index 
range (COh to CFh) result in extemal I/O cycles 
and do not effect the on-chip configuration registers. 
Reads of port 22h are always directed off-chip. 

2.4.2 Memary Address Space 

The Cx486SLC directly addresses up to 16 
MBytes of physical memory. Memory address 
space is accessed as bytes, words (16-bits) or 
doublewords (32-bits). Words and doublewords 
are stored in consecutive memory bytes with the 
low-order byte located in the lowest address. The 
physical address of a word or doubleword is the 
byte address of the low-order byte. 



With the Cx486SLC, memory can be addressed 
using nine different addressing modes. These 
addressing modes are used to calculate an offset 
address often referred to as an effective address. 
Depending on the operating mode of the CPU, 
the offset is then combined using memory 
management mechanisms to create a physical 
address that actually addresses the physical 
memory devices. 

Memory management mechanisms on the 
Cx486SLC consist of segmentation and paging. 
Segmentation allows each program to use several 
independent, protected address spaces. Paging 
supports a memory subsystem that simulates a 
large address space using a small amount of RAM 
and disk storage for physical memory. Either or both 
of these mechanisms can be used for manage- 
ment of the Cx486SLC memory address space. 

2.4.2.1 Offset Mechanism 

The offset mechanism computes an offset (effec- 
tive) address by adding together up to three 
values: a base, an index and a displacement. The 
base, if present, is the value in one of eight 32-bit 
general registers at the time of the execution of 
the instruction. The index, like the base, is a 
value that is determined from one of the 32-bit 
general registers (except the ESP register) when 
the instruction is executed. The index differs 
from the base in that the index is first multiplied 
by a scale factor of 1, 2, 4 or 8 before the summa- 
tion is made. The third component added to 
the memory address calculation is the displace- 
ment which is a value of up to 32-bits in length 
supplied as part of the instruction. Figure 2-15 
illustrates the calculation of the offset address. 
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Nine valid combinations of the base, index, scale 
factor and displacement can be used with the 
Cx486SLC instruction set. These combinations 
are listed in Table 2-12. The base and index both 
refer to contents of a register as indicated by 
[Base] and [Index]. 









Index 






















Base 






Displacement 
























Scaling 
xl,x2, x4,x8 








A. 






]7(M0 


^ Offset Address 

(Effective Address) 





Figure 2-1 5. Offset Address Calculation 



Table 2- 1 2. Memory Addressing Modes 



ADDRESSING 
MODE 


BASE 


INDEX 


SCALE 
FACTOR 


DISPLACEMENT 
(Dp) 


OFFSET ADDRESS (OA) 
CALCULATION 


Direct 








X 


OA = DP 


Register Indirect 


x 








OA = [BASE] 


Based 


X 






X 


OA = [BASE] + DP 


Index 




X 




X 


OA = [INDEX] + DP 


Scaled Index 




X 


X 


X 


OA = ([INDEX] * SF) + DP 


Based Index 


X 


X 






OA = [BASE] + [INDEX] 


Based Scaled 
Index 


X 


X 


X 




OA = [BASE] + ([INDEX] * SF) 


Based Index with 
Displacement 


X 


X 




X 


OA = [BASE] + [INDEX] + DP 


Based Scaled 
Index with 
Displacement 


X 


X 


X 


X 


OA = [BASE] + ([INDEX] * SF) + DP 
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2.4.2.2 Real Mode Meenoiy 
Addressing 

In real mode operation, the Cx486SLC only 
addresses the lowest 1 MByte (2^°) of memory. 
To calculate a physical memory address, the 16- 
bit segment base address located in the selected 
segment register is shifted left by four bits and 
then the 16-bit offset address is added. The 
resulting 20-bit address is then extended with 
four zeros in the upper address bits to create the 



24-bit physical address. Figure 2-16 illustrates 
the real mode address calculation. Physical 
addresses beyond 1 MByte cause a segment limit 
overrun exception. 

The addition of the base address and the offset 
address may result in a carry. Therefore, the 
resulting address may actually contain up to 21 
significant address bits that address memory in 
the first 64 KBytes above 1 MByte. 















linear Address = Physical Address 

1708300 




Offset Mechanism 


Offset Addresss 


















Selected Segment 
Register 




X16 



















Pigure 2-16. Heal Mode Address CalcyiatioBi 



2.4.2.3 Protected Made Memary 
Addressing 

In protected mode three mechanisms calculate a 
physical memory address (Figure 2-17). 

® Offeet Mechanism that produces the offset 
or effective address as in real mode. 

• Selector Mechanism that produces the base 
address. 

• Optional Paging Mechanism that translates a 
linear address to the physical memory address. 



The offset and base address are added together to 
produce the linear address. If paging is not used, 
the linear address is used as the physical memory 
address. If paging is enabled, the paging mecha- 
nism is used to translate the linear address into 
the physical address. The offset mechanism is 
described earlier in this section and applies to 
both real and protected mode. The selector and 
paging mechanisms are described in the follow- 
ing paragraphs. 
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Figure 2- 1 7. Protected Mode Address Calculation 



Selector Mechanism 

Memory is divided into an arbitrary number of 
segments, each containing usually much less than 
the 1?^ byte (4 GByte) maximum. 

The six segment registers (CS, DS, SS, ES, FS and 
GS) each contain a 16-bit selector that is used 
when the register is loaded to locate a segment 
descriptor in either the global descriptor table 
(GDT) or the local descriptor table (LDT). The 
segment descriptor defines the base address, limit 



and attributes of the selected segment and is cached 
on the Cx486SLC as a result of loading the selector. 
The cached descriptor contents are not visible to 
the programmer. When a memory reference 
occurs in protected mode, the linear address is 
generated by adding the segment base address in 
the hidden portion of the segment register to the 
offset address. If paging is not enabled, this linear 
address is used as the physical memory address. 
Figure 2-18 illustrates the operation of the 
selector mechanism. 
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Paging Mechanism 

The paging mechanism supports a memory 
subsystem that simulates a large address space 
with a small amount of RAM and disk storage. 
The paging mechanism either translates a linear 
address to its corresponding physical address or 
generates an exception if the required page is not 
currently present in RAM. When the operating 
system services the exception, the required page 
is loaded into memory and the instruction is then 
restarted. Pages are always 4 KBytes in size and 
are aligned to 4 KByte boundaries. 

A page is addressed by using two levels of tables 
as illustrated in Figure 2-19. The upper 10 bits 
of the 32-bit linear address are used to locate an 
entry in the page directory table. The page direc- 
tory table acts as a 32-bit master index to up to 
IK individual second-level page tables. The 
selected entry in the page directory table, referred 
to as the directory table entry, identifies the 
starting address of the second-level page table. 
The page directory table itself is a page and is. 



therefore, aligned to a 4 KByte boundary. The 
physical address of the current page directory is 
stored in the CR3 control register, also referred to 
as the Page Directory Base Register (PDBR). 

Bits 12-21 of the 32-bit linear address, referred to 
as the Page Table Index, locate a 32-bit entry in 
the second-level page table. This Page Table 
Entry (PTE) contains the base address of the 
desired page frame. The second-level page table 
addresses up to IK individual page frames. A 
second-level page table is 4 KBytes in size and is 
itself a page. The lower 12 bits of the 32-bit 
linear address, referred to as the Page Frame 
Offset, locate the desired data within the page 
frame. 

Since the page directory table can point to IK 
page tables, and each page table can point to 1 K 
of page frames, a total of IM of page frames can 
be implemented. Since each page contains 4 
KBytes, up to 4 GBytes of virtual memory can be 
addressed by the Cx486SLC with a single page 
directory table. 
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Figure 2- 1 9. Paging Mechanism 

In addition to the base address of the page table or the page frame, each Directory Table Entry or Page 
Table Entry contains attribute bits and a present bit as illustrated in Figure 2-20 and listed in Table 2-13. 
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Figure 2-20. Directory and Page Table Entry (DTE and PTE) Format 
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Table 2-13. Ilirecffoiy and Page Table Entry (DTE and PTE} Bit Definitions 



BIT POSITION 


FIELD NAME 


DESCRIPTION 


31-12 


BASE 
ADDRESS 


Specifies the base address of the page or page table. 


11-9 


~ 


Undefined and available to the programmer. 


8-7 


~ 


Reserved and not available to the programmer. 


6 


D 


Dirty Bit. If set, indicates that a write access has occurred to the 
page (PTE only, undefined in DTE). 


5 


A 


Accessed Flag. If set, indicates that a read access or write access has 
occurred to the page. 


4 


PCD 


Page Caching Disable flag. If set, indicates that the page is not 
cacheable in the on-chip cache. 


3 


~ 


Reserved and not available to the programmer. 


2 


u/s 


User/Supervisor Attribute. If set (user), page is accessible at all 
privilege levels. If clear (supervisor), page is accesible only when 
CPL< =2. 


1 


W/R 


Write/Read Attribute. If set (write), page is writable. If clear (read), 
page is read only. 





P 


Present Flag. If set, indicates that the page is present in RAM memory, 
and validates the remaining DTE/PTE bits. If clear, indicates that the 
page is not present in memory and the remaining DTE/PTE bits can be 
used by the programmer. 



If the present bit (P) is set in the DTE, the page 
table is present and the appropriate page table 
entry is read. If P = 1 in the corresponding PTE 
(indicating that the page is in memory), the 
accessed and dirty bits are updated and the 
operand is fetched. Both accessed bits are set 
(DTE and PTE), if necessary, to indicate that the 
table and the page have been used to translate a 
linear address. The dirty bit (D) is set before the 
first write is made to a page.. 



The present bits must be set to vaHdate the 
remaining bits in the DTE and PTE. If either of 
the present bits are not set, a page fault is gener- 
ated when the DTE or PTE is accessed. If P=0, 
the remaining DTE/PTE bits are available for use 
by the operating system. For example, the 
operating system can use these bits to record 
where on the hard disk the pages are located. A 
page fault is also generated if the memory refer- 
ence violates the page protection attributes. 



PRELIMRNAHY 



2-37 



^f Mincing the Standards 



Interrupts and Exceptions 



Translation Look-Aside Buffer 

The translation look-aside buffer (TLB) is a cache 
for the paging mechanism and replaces the two-level 
page table lookup procedure for cache hits. The 
TLB is a four-way set associative 32-entry page table 
cache that automatically keeps the most commonly 
used page table entries in the processor. The 
32-entry TLB, coupled with a 4K page size, results in 
coverage of 128 KBytes of memory addresses. 

The TLB must be flushed when entries in the 
page tables are changed. The TLB is flushed 
whenever the CR3 register is loaded. An indi- 
vidual entry in the TLB can be flushed using the 
INVLPG instruction. 



2.5 



Interrupts and Exceptions 



An interrupt or exception changes the sequential 
flow of a program by transferring program 
control to a service routine. Both software and 
hardware interrupts can occur. Software inter- 
rupts occur as the result of execution of an INT 
instruction. Hardware interrupts occur in re- 
sponse to an external interrupt request on the 
non-maskable interrupt (NMl) or maskable intermpt 
(INTR) input pins. Exceptions occur as the result of 
the execution of an instruction that provokes an 
exception condition. For example, an illegal opcode 
or a stack fault generates an exception. 

When the Cx486SLC services an interrupt or 
exception, the current program's address and 
flags are pushed onto the stack to allow resump- 
tion of execution of the interrupted program. In 
protected mode, the processor also saves an error 
code for some exceptions. Program control is 
then transferred to the interrupt handler (also 
called the interrupt service routine). Upon 
execution of an IRET at the end of the service 
routine, program execution resumes at the 
interrupted instruction. 



The Cx486SLC accepts up to 256 different 
interrupts. Each interrupt has a corresponding 
vector. The vector number is used by the 
Cx486SLC to locate an entry in the interrupt 
descriptor table (IDT). In real mode, each IDT 
entry is a four-byte far pointer to the entry point 
of the corresponding interrupt service routine. In 
protected mode, each IDT entry is an eight-byte 
descriptor. The IDTR register specifies the 
beginning address and limit of the IDT. FoUow- 
ing reset, the IDTR contains a base address of Oh 
with a limit of 3FFh. 

The IDT can be located anywhere in physical 
memory as determined by the IDTR register. The 
IDT may contain different types of descriptors: 
interrupt gates, trap gates and task gates. Inter- 
rupt gates are used mostly to enter a hardware 
interrupt handler. Trap gates are generally used 
to enter an exception interrupt handler or soft- 
ware interrupt handler. If an interrupt gate is 
used, the Interrupt Enable Flag (IF) in the 
EFLAGS register is cleared before the interrupt 
handler is entered. Task gates are used to make 
the transition to a new task. 

Exceptions and the hardware NMI have assigned 
vectors in the range from 0-31, as shown in Table 
2-14. Not all of these first 32 vectors are used by 
the Cx486SLC, however, unassigned vectors are 
reserved r .id should not be used. The vectors for 
the hardware INTR interrupts are generated by 
external hardware. In response to an unmasked 
INTR, the Cx486SLC issues interrupt acknowl- 
edge bus cycles used to read the value of the 
vector from external hardware. Any vector in the 
range from 32 to 255 may be used. Software INT 
instructions include the vector as part of the 
instruction opcode. 
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Table 2-14. Interrupt Vector Assignments 



INTERRUPT VECTOR 


FUNCTION 


EXCEPTION TYPE 





Divide error. 


FAULT 


1 


Debug exception. 


TRAP* 


2 


NMI interrupt 




3 


Breakpoint. 


TRAP 


4 


Interrupt on overflow. 


TRAP 


5 


BOUND range exceeded. 


FAULT 


6 


Invalid opcode. 


FAULT 


7 


Device not available. 


FAULT 


8 


Double fault. 


ABORT 


9 


Coprocessor segment overrun. 


ABORT 


10 


Invalid TSS. 


FAULT 


11 


Segment not present. 


FAULT 


12 


Stack fauk. 


FAULT 


13 


General protection fault. 


FAULT 


14 


Page fault. 


FAULT/TRAP 


15 


Reserved. 




16 


Coprocessor error. 


FAULT 


17 


Alignment check exception. 


FAULT 


18-31 


Reserved. 




32-255 


Maskable hardware interrupts. 


TRAP 


0-255 


Programmed interrupt. 


TRAP 



*Note: Some debug exceptions may report both traps on the previous instruction and faults on the next instruction. 



2. 5. 1 Exceptions 

Exceptions can be classified in three different 
categories depending on the way they are re- 
ported and if the instruction which first caused 
the exception can be restarted. Table 2-14 lists 
the exception type for each of the Cx486SLC 
exceptions. 

Fault exceptions are reported for the current 
instruction. The instruction is nullified and the 
fault is reported with the CPU in a state which 
permits the faulting instruction to be restarted. 



Trap exceptions are reported immediately after 
the execution of the instruction that caused the 
exception. The instruction pointer restored after 
execution of the service routine points to the 
instruction following the instruction that caused 
the trap. Software interrupt instructions also 
operate like trap exceptions. 

Abort exceptions are caused by a very severe 
system error. The catastrophic nature of the 
error does not always allow sufficient information 
to determine the precise location of the instruc- 
tion causing the problem and does not allow 
restart of the program. 
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2.5.1 .1 Exceptions in Real fWode 

Many of the exceptions described in Table 2-14 
are not applicable in real mode. Exceptions 10, 
1 1 , and 14 do not occur in real mode. Other 
exceptions have slightly different meanings in real 
mode as listed in Table 2-15. 



Table 2-1 5. Exception Ciianges in Real Mode 



VECTOR NUMBER 


PROTECTED MODE FUNCTION 


REAL MODE FUNCTION 


8 


Double fault. 


Interrupt table limit overrun. 


10 


Invalid TSS. 


-- 


11 


Segment not present. 


-- 


12 


Stack fault. 


SS segment limit overrun. 


13 


General protection fault. 


CS, DS, ES, FS, GS segment limit overrun. 


14 


Page fault. 


- 



Note: ~ = does not occur 

2.5. 1.2 Error Codes 

When operating in protected mode, the following 
exceptions generate a 16-bit error code: 

Double Fault 
Alignment Check 
Invalid TSS 
Segment Not Present 
Stack Fault 

General Protection Fault 
Page Fault 



The error code format is shown in Figure 2-21 
and the error code bit definitions are listed in 
Table 2-16. Bits 15-3 (selector index) are not 
meaningful if the error code was generated as the 
result of a page fault. The error code is always 
zero for double faults and alignment check 
exceptions. 
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Figure 2-2 1 • Error Code Format 
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Table 2- 1 6. Error Code Bit Definitions 



FAULT 
TYPE 


SELECTOR 

INDEX 

(BITS 1 5-3) 


S2 
(BIT 2) 


SI 
(BIT 1) 


SO 
(BIT 0) 


Page Fault 


Reserved 


Fault caused by: 


Fault occurred 


Fault occurred during: 






= not present page, 


during: 


= supervisor access. 






1 = page-level 


= read access, 


1 = user access. 






protection vioation. 


1 = write access. 




IDT Fault 


Index of faulty 
IDT selector. 


Reserved. 


1 


If, set exception 
occurred while trying 
to invoke exception or 
hardware interrupt 
handler. 


Segment 


Index of faulty 


TI bit of faulty 





If, set exception 


Fault 


selector. 


selector. 




occurred while trying 
to invoke exception or 
hardware interrupt 
handler. 
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2.5.2 Hardware Interrupts 

Hardware interrupts are classified as either 
maskable or non-maskable. In most cases, 
hardware interrupts are serviced after the current 
instruction is completed. After the interrupt 
handler is finished, execution continues in the 
original program with the instruction immedi- 
ately following the interrupted instruction. 

Non-maskable interrupts provide a method of 
servicing very high priority interrupts. When the 
NMI input is asserted, the CPU automatically 
transfers program control to the interrupt service 
routine corresponding to vector 2. Since the 
interrupt vector is fixed and is supplied internally, 
no interrupt acknowledge bus cycles are performed. 

While executing the NMI service routine, the 
Cx486SLC microprocessor does not service any 
fiarther NMI requests until an iatermpt retum (IRET) 
instruction is executed or the processor is reset. 
If another NMI occurs while cunently servicing an 
NMI, its presence is saved for servicing after execu- 
tion of the next IRET instruction. It is recommended 
that an interrupt gate be used for the NMI in order to 
disable nested maskable interrupts. Execution of 
an IRET instruction in the maskable interrupt 
handler allows the NMI to be re-enabled. 

Hardware maskable interrupts occur when 
the INTR pin is asserted and the Interrupt Enable 
Flag (IF) bit is set to 1 in the EFLAGS register. 
The processor only responds to maskable inter- 
rupts between instructions (string instructions 
have an interrupt window between memory 
moves that allows interrupts during long string 
moves). When an interrupt occurs, the processor 
reads an 8-bit vector supplied by external system 
hardware. This vector selects which of the 256 
possible interrupt handlers is executed in re- 
sponse to the interrupt. 



2.5.3 Software Interrupts 

The third type of interrupt/exception for the 
Cx486SLC microprocessor is the software inter- 
rupt. An INT n instruction causes the processor 
to execute the interrupt service routine pointed to 
by the nth vector in the interrupt table. Execu- 
tion of the interrupt service routine occurs regardless 
of the state of the IF flag in the EFLAGS register. 

The one byte INT 3, or breakpoint interrupt, is a 
particular case of the two-byte INT n interrupt. 
By inserting this one byte instruction in a pro- 
gram, the user can set breakpoints in his program 
that can be used during debug. 

The last type of software interrupt is the single- 
step trap. The single-step feature is enabled by 
setting the TF flag in the EFLAGS register. This 
causes the processor to generate a debug excep- 
tion after the execution of every instruction. 

2.5.4 Inteirupt and Exception 
Priorities 

Hardware interrupts are generated external to the 
CPU. Maskable interrupts produced on the INTR 
pin and non-maskable interrupts produced on the 
NMI input are recognized between instructions. 
When NMI and maskable INTR interrupts are 
both detected at the same instruction boundary, 
the Cx486SLC microprocessor services the NMI 
interrupt first. 

Exceptions are generated internal to the CPU. 
The Cx486SLC checks for exceptions in parallel 
with instruction decoding and execution. Several 
exceptions can result from a single instruction. 
However, only one exception is generated upon 
each attempt to execute the instruction. Each 
exception service routine should make the appro- 
priate corrections to the instruction and then 
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restart the instruction. In this way, exceptions 
can be serviced until the instruction executes 
properly. 

The Cx486SLC supports instruction restart after 
all faults, except when an instruction causes a 
task switch to a task whose task state segment 
(TSS) is partially not present. A TSS can be 



partially not present if the TSS is not page aligned 
and one of the pages where the TSS resides is not 
currently in memory. 

As the Cx486SLC executes instructions, it follows 
a consistent policy for prioritizing exceptions and 
hardware interrupts as listed in Table 2-17. 



Table 2- 1 7. interrupt and Exception Priorities 



PRIORHTY 


DESCRIPTION 


NOTES 


1 


Debug traps and faults from previous 
instruction. 


Includes single-step trap and data breakpoints 
specified in the debug registers. 


2 


Debug traps for next instruction. 


Includes instruction execution breakpoints 
specified in the debug registers. 


3 


Non-maskable hardware interrupt. 


Caused by NMI asserted. 


4 


Maskable hardware interrupt. 


Caused by INTR asserted and IF = 1. 


5 


Faults resulting from fetching the next 
instruction. 


Includes segment not present, general protection 
fault and page fault. 


6 


Faults resulting from instruction decoding. 


Includes illegal opcode, instruction too long, or 
privilege violation. 


7 


WAIT instruction and TS = 1 and MP = 1. 


Device not available exception generated. 


8 


ESC instruction and EM = 1 or TS = 1. 


Device not available exception generated. 


9 


Coprocessor error exception. 


Caused by ERROR# asserted. 


10 


Segmentation faults (for each memory 
reference required by the instruction) that 
prevent transferring the entire mtmory 
operand. 


Includes segment not present, stack fault, and 
general protection fault. 


11 


Page Faults that prevent transferring the 
entire memory operand. 




12 


Alignment check fault. 
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The halt instruction (HLT) stops program 
execution and prevents the processor from using 
the local bus until restarted. The Cx486SLC then 
enters a low-power suspend mode. NMI, INTR 
with interrupts enabled (IF bit in EFLAGS=1), or 
RESET forces the CPU out of the halt state. If 
interrupted, the saved code segment and instruction 
pointer specify the instruction following the HLT. 

Shutdown occurs when a severe error is de- 
tected that prevents further processing. An NMI 
input can bring the processor out of shutdown if 
the IDT limit is large enough to contain the NMI 
interrupt vector (at least OOOFh) and the stack has 
enough room to contain the vector and flag 
information (i.e., stack pointer is greater tlian 0005h). 
Otherwise, shutdown can only be exited by a 
processor reset. 



2.7 



Protection 



Segment protection and page protection are 
safeguards built into the Cx486SLC protected 
mode architecture which deny unauthorized or 
incorrect access to selected memory addresses. 
These safeguards allow multitasking programs to 
be isolated from each other and from the operat- 
ing system. Page protection is discussed earlier in 
this chapter in section 2.4. This section concen- 
trates on segment protection. 

Selectors and descriptors are the key elements in 
the segment protection mechanism. The segment 
base address, size, and privilege level are estab- 
lished by a segment descriptor. Privilege levels 
control the use of privileged instructions, I/O 
instructions and access to segments and segment 



descriptors. Selectors are used to locate segment 
descriptors. 

Segment accesses are divided into two basic 
types, those involving code segments (e.g, control 
transfers) and those involving data accesses. The 
ability of a task to access a segment depends on: 

• the segment type 

• the instruction requesting access 

• the type of descriptor used to define the 

segment 

• the associated privilege levels 

(described below). 

Data stored in a segment can be accessed only by 
code executing at the same or a more privileged 
level. A code segment or procedure can only be 
called by a task executing at the same or a less 
privileged level. 

2.7.1 Privilege levels 

The values for privilege levels range between 
and 3. Level is the highest privilege level (most 
privileged), and level 3 is the lowest privilege 
level (least privileged). The privilege level in real 
mode is effectively 0. 

The Descriptor Privilege Level (DPL) is the 
privilege level defined for a segment in the 
segment descriptor. The DPL field specifies the 
minimum privilege level needed to access the 
memory segment pointed to by the descriptor. 

The Current Privilege Level (CPL) is defined as 
the current task's privilege level. The CPL of an 
executing task is stored in the hidden portion of 
the code segment register and essentially is the 
DPL for the current code segment. 
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The Requested Privilege Level (RPL) specifies a 
selector's privilege level and is used to distinguish 
between the privilege level of a routine actually 
accessing memory (the CPL), and the privilege 
level of the original requestor (the RPL) of the 
memory access. The lesser of the RPL and CPL is 
called the effective privilege level (EPL). There- 
fore, if RPL = in a segment selector, the effective 
privilege level is always determined by the CPL. 
If RPL = 3, the effective privilege level is always 3 
regardless of the CPL. 

For a memory access to succeed, the effective 
privilege level (EPL) must be at least as privileged 
as the descriptor privilege level (EPL < DPL). If 
the EPL is less privileged than the DPL (EPL > DPL), 
a general protection fault is generated. For 
example, if a segment has a DPL = 2, an instruc- 
tion accessing the segment only succeeds if 
executed with an EPL < 2. 

2.7.2 I/O Privilege Levels 

The I/O Privilege Level (lOPL) allows the 
operating system executing at CPL=0 to define 
the least privileged level at which lOPL-sensitive 
instructions can unconditionally be used. The 
lOPL-sensitive instructions include CLI, IN, OUT, 
INS, OUTS, REP INS, REP OUTS, and STL 
Modification of the IF bit in the EFLAGS register 
is also sensitive to the I/O privilege level. 

The lOPL is stored in the EFLAGS register. An I/O 
permission bit map is available as defined by the 



32-bit Task State Segment (TSS). Since each task 
can have its own TSS, access to individual I/O 
ports can be granted through separate I/O 
permission bit maps. 

If CPL < lOPL, lOPL-sensitive operations can be 
performed. If CPL > lOPL, a general protection 
fault is generated if the current task is associated 
with a 16-bit TSS. If the current task is associated 
with a 32-bit TSS and CPL > lOPL, the CPU 
consults the I/O permission bitmap in the TSS to 
determine on a port-by-port basis whether or not 
I/O instructions (IN, OUT, INS, OUTS, REP INS, 
REP OUTS) are permitted, and the remaining 
lOPL-sensitive operations generate a general 
protection fault. 

2.7.3 Privilege Level TraBisfers 

A task's CPL can be changed only through 
intersegment control transfers using gates or task 
switches to a code segment with a different 
privilege level. Control transfers result from 
exception and interrupt sevicing and from 
execution of the CALL, JMP, INT, IRET and RET 
instructions. 

There are five types of control transfers that are 
summarized in Table 2-18. Control transfers can 
be made only when the operation causing the 
control transfer references the correct descriptor 
type. Any violation of these descriptor usage 
rules causes a general protection fault. 
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Table 2- 1 8. Descriptor Types Used for Control Transfer 



TYPE OF CONTROL TRANSFER 


OPERATION 
TYPES 


DESCRIPTOR 
REFERENCED 


DESCRIPTOR 
TABLE 


Intersegment within the same privilege level. 


JMP, CALL, RET, IRET* 


Code Segment 


GDT or LDT 


Intersegment to the same or a more* 

privileged level. 

Interrupt within task (could change CPL 

level). 


CALL 


Call Gate 


GDT or LDT 


Interrupt Instruction, 
Exception, External 
Interrupt 


Trap or Interrupt 
Gate 


IDT 


Intersegment to a less privileged level 
(changes task CPL). 


RET, IRET* 


Code Segment 


GDT or LDT 


Task Switch via TSS 


CALL, JMP 


Task State Segment 


GDT 


Task Switch via Task Gate 


CALL, JMP 


Task Gate 


GDT or LDT 


IRET**, Intemipt 
Instruction, Exception, 
External Interrupt 


Task Gate 


IDT 



*= NT (Nested Task bit in EFLAGS) = 
•= NT (Nested Task bit in EFLAGS) = 1 



2.7.3.1 Gates 



Any control transfer that changes the CPL within 
a task results in a change of stack. The initial 
values for the stack segment (SS) and stack 
pointer (ESP) for privilege levels 0, 1, and 2 are 
stored in the TSS. During a JMP or CALL control 
transfer, the SS and ESP are loaded with the new 
stack pointer and the previous stack pointer is 
saved on the new stack. When returning to the 
original privilege level, the RET or IRET instruc- 
tion restores the less-privileged stack. 



Gate descriptors provide protection for privilege 
transfers among executable segments. Gates are 
used to transition to routines of the same or a 
more privileged level. Call gates, interrupt gates 
and trap gates are used for privilege transfers 
within a task. Task gates are used to transfer 
between tasks. 

Gates conform to the standard rules of privilege. 
In other words, gates can be accessed by a task if 
the effective privilege level (EPL) is the same or 
more privileged than the gate descriptor's privi- 
lege level (DPL). 
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2.7.4 Initialization and 

Transition To Protected 
Mode 

The Cx486SLC microprocessor switches to Real 
Mode immediately after RESET. While operating in 
real mode, the system tables and registers should be 
initialized. The GDTR and IDTR must point to a 
valid GDT and IDT, respectively. The size of the 
IDT should be at least 256 bytes, and the GDT must 
contain descriptors which describe the initial code 
and data segments. 

The processor can be placed in protected mode by 
setting the PE bit in the CRO register. After enabling 
protected mode, the CS register should be loaded 
and the instruction decode queue should be flushed 
by executing an intersegment JMP. Finally, all data 
segment registers should be initialized with appro- 
priate selector values. 
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Both Real Mode and Virtual 8086 (V86) Mode are 
supported by the Cx486SLC CPU aUowing execu- 
tion of 8086 application programs and 8086 operat- 
ing systems. V86 Mode allows the execution of 
8086-type applications, yet still permits use of the 
Cx486SLC protection mechanism. V86 tasks run at 
privilege level 3. Upon entry, all segment limits are 
set to FFFFh (64K) as in real mode. 

2.8.1 Memory Addressing 

While in V86 mode, segment registers are used in 
an identical fashion to Real Mode. The contents of 
the segment register are shifted left four bits and 
added to the offset to form the segment base linear 
address. The Cx486SLC CPU permits the operating 



system to select which programs use the V86 
address mechanism and which programs use 
protected mode addressing for each task. 

The Cx486SLC also permits the use of paging 
when operating in V86 mode. Using paging, 
the 1 -MByte address space of the V86 task can 
be mapped to anywhere in the 4-GByte linear 
address space of the Cx486SLC CPU. As in 
real mode, linear addresses that exceed 1 
MByte cause a segment limit overrun exception. 

The paging hardware allows multiple V86 
tasks to run concurrently, and provides 
protection and operating system isolation. The 
paging hardware must be enabled to run 
multiple V86 tasks or to relocate the address 
space of a V86 task to physical address space 
greater than 1 MByte. 

2.8.2 Protection 

All V86 tasks operate with the least amount of 
privilege (level 3) and are subject to all of the 
Cx486SLC protected mode protection checks. 
As a result, any attempt to execute a privileged 
instruction within a V86 task results in a 
general protection fault. 

In V86 mode, a slightly different set of instruc- 
tions are sensitive to the VO privilege level (lOPL) 
than in protected mode. These instructions 
are: CLI, INT n, IRET, POPE, PUSHE, and 
STI. The INT3, INTO and BOUND variations 
of the INT instruction are not lOPL sensitive. 
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2.8.3 Interrupt Handling 

To fully support the emulation of an 8086-type 
machine, interrupts in V86 mode are handled as 
follows. When an interrupt or exception is 
serviced in V86 mode, program execution 
transfers to the interrupt service routine at 
privilege level (i.e., transition from V86 to 
protected mode occurs) and the VM bit in the 
EFLAGS register is cleared. The protected mode 
interrupt service routine then determines if the 
interrupt came from a protected mode or V86 
application by examining the VM bit in the 
EFLAGS image stored on the stack. The interrupt 
service routine may then choose to allow the 
8086 operating system to handle the interrupt or 
may emulate the function of the interrupt han- 
dler. Following completion of the interrupt 
service routine, an IRET instruction restores the 
EFLAGS register (restores VM=1) and segment 
selectors and control returns to the interrupted 
V86 task. 



2.8.4 Entering and Leaving 
V86 Mode 

V86 mode is entered from protected mode by 
either executing an IRET instruction at GPL = 
or by task switching. If an IRET is used, the stack 
must contain an EFLAGS image with VM=1 . If a 
task switch is used, the TSS must contain an 
EFLAGS image containing a 1 in the VM bit 
position. The POPE instruction cannot be used 
to enter V86 mode since the state of the VM bit is 
not effected. V86 mode can only be exited as the 
result of an interrupt or exception. The transition 
out must use a 32-bit trap or interrupt gate which 
must point to a non-conforming privilege level 
segment (DPL = 0), or a 32-bit TSS. These 
restrictions are required to permit the trap 
handler to IRET back to the V86 program. 
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3. BUS INTERFACE 

3.1 Overview 

The following sections describe the Cx486SLC input and output signals. The discussion of these 
signals is arranged by functional groups as shown in Figure 3-T Table 3-1 gives a brief description of 
each of the Cx486SLC signals. 
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Table 3-1. Cx486SLC Signal Summary 



SIGNAL 


SIGNAL NAME 


SIGNAL GROUP 


A20M# 


ADDRESS BIT 20 MASK 




A23-A1 


ADDRESS BUS LINES 


Address Bus 


ADS# 


ADDRESS STROBE 


Bus Cycle Control 


BHE# 


BYTE HIGH ENABLE 


Address Bus 


BLE# 


BYTE LOW ENABLE 


Address Bus 


BUSY# 


PROCESSOR EXTENSION BUSY 


Coprocessor Interface 


CLK2 


2X CLOCK INPUT 




D15-D0 


DATA BUS 




D/C# 


DATA/CONTROL 


Bus Cycle Definition 


ERROR# 


PROCESSOR EXTENSION ERROR 


Coprocessor Interface 


FLT# 


FLOAT 




FLUSH# 


CACHE FLUSH 


Internal Cache Interface 


INTR 


MASKABLE INTERRUPT REQUEST 


Interrupt Control 


HLDA 


HOLD ACKNOWLEDGE 


Bus Arbitration 


HOLD 


HOLD REQUEST 


Bus Arbitration 


LOCK# 


BUS LOCK 


Bus Cycle Definition 


KEN# 


CACHE ENABLE 


Internal Cache Interface 


W10# 


MEMORY/INPUT-OUTPUT 


Bus Cycle Definition 


NA# 


NEXT ADDRESS REQUEST 


Bus Cycle Control 


NMI 


NON-MASKABLE INTERRUPT REQUEST 


Interrupt Control 


PEREQ 


PROCESSOR EXTENSION REQUEST 


Coprocessor Interface 


READY# 


BUS READY 


Bus Cycle Control 


RESET 


RESET 




RPLSET 


REPLACEMENT SET 


Internal Cache Interface 


RPLVAL# 


REPLACEMENT SET VALID 


Internal Cache Interface 


SUSP# 


SUSPEND REQUEST 


Power Management 


SUSPA# 


SUSPEND ACKNOWLEDGE 


Power Management 


W/R# 


WRITE/READ 


Bus Cycle Definition 



The "#" (pound) symbol following a signal name 
indicates that when the signal is in its active 
(asserted) state, the signal is at a logic low level. 
When the # is not present at the end of a signal 
name, the logic high level represents the active 
state. The following two sections describe the 
signals and their functional timing characteristics. 



Additional signal information may be found in 
Chapter 4, Electrical Specifications. Chapter 4 
documents the DC and AC characteristics for the 
signals including voltage levels, propagation 
delays, setup times and hold times. Specified 
setup and hold times must be met for proper 
operation of the Cx486SLC. 
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3.2 Signal Descriptions 

3.2.1 2XCIockinput 

The 2X Clock Input (CLK2) signal is the 
basic timing reference for the Cx486SLC 
microprocessor. The CLK2 input is 
internally divided by two to generate the 
internal processor clock. The external 
CLK2 is synchronized to a known phase of 
the internal processor clock by the falling 
edge of the RESET signal. External timing 
parameters are defined with respect to the 
rising edge of CLK2. 

3.2.2 Reset 

Reset is an active high input signal that, 
when asserted, suspends all operations in 
progress and places the Cx486SLC into a 
reset state. RESET is a level sensitive 
synchronous input and must meet speci- 
fied setup and hold times to be recognized 
by the Cx486SLC properly. TheCx486SLC 
begins executing instructions at physical 
address location FF FFFOh approximately 
400 CLK2s after RESET is driven inactive 
(low). While RESET is active, all other 
input pins, except FLT#, are ignored. The 
remaining signals are initialized to their 
reset state during the internal processor 
reset sequence. The reset signal states for 
the Cx486SLC are shown in Table 3-2. 



Table 3-2. Signal States During Reset 


SIGNAL NAME 


SIGNAL STATE DURING RESET 


A20M# 


Ignored 


A23-A1 


1 


ADS# 


1 


BHE#, BLE# 





BUSY# 


Ignored 


D15-D0 


Float 


D/C# 


1 


ERROR# 


Ignored 


FLT# 


Input Recognized 


FLUSH# 


Ignored 


HLDA 





HOLD 


Ignored 


INTR 


Ignored 


KEN# 


Ignored 


LOCK# 


1 


M/IO# 





NA# 


Ignored 


NMI 


Ignored 


PEREQ 


Ignored 


READY# 


Ignored 


RESET 


Input Recognized 


RPLSET 


Float 


RPLVAL# 


Float 


SUSP# 


Ignored 


SUSPA# 


Float 


W/R# 
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3«!2.3 Address Bus 

The Address Bus (A23-A1) signals are three- 
state outputs that provide physical memory or I/O 
port addresses. All address lines can be used for 
addressing physical memory allowing a 16 MB 
address space (00 OOOOh to FF FFFFh). During 1/0 
port accesses, except for coprocessor accesses, 
A23-A16 are driven low. This allows for a 64 
KByte VO address space (00 OOOOh to 00 FFFFh). 
During coprocessor I/O accesses, A22-A16 are 
driven low and A23 is driven high to allow it to 
be used by external logic to generate a coproces- 
sor select signal. Consequently, for coprocessor I/O 
cycles the 486SLC drives address 80 OOFSh with 
command transfers and address 80 OOFCh or 
8000 FEh with data transfers. A23-A1 float 
while the CPU is in a hold acknowledge or float 
state. 

Byte Low Enable (BLE#) and Byte High 
Enable (BHE#) are three-state outputs that are 
driven when the address is active, during a 
memory or I/O access. These signals indicate 
which bytes of the 16-bit data bus are active 
during the current bus cycle. BLE# is associated 
with the low byte, D7-D0, and BHE# is associated 
with the high byte, D15-D8. When BHE# and 
BLE# are both asserted, all 16 bits (high and low 
bytes) of the data bus are active in the current bus 
cycle. Table 3-3 below defines the possible states 
of the byte enables during a bus cycle. BLE# and 
BHE# float while the CPU is in a hold acknowl- 
edge or float state. 



3«2.4 Data Bus 

The Data Bus (D15-D0) signals are three-state 
bidirectional signals which provide the data path 
between the Cx486SLC and external memory 
and I/O devices. The data bus inputs data during 
memory read, I/O read and interrupt acknowl- 
edge cycles and outputs data during memory and 
I/O write cycles. Data read operations require 
that specified data setup and hold times be met 
for correct operation. The data bus signals are 
high active and float while the CPU is in a hold 
acknowledge or float state. 

3.2.5 Bus Cycle Definition 

The bus cycle definition (M/IO#, D/C#, W/R#, 
LOCK#) signals consist of four three-state out- 
puts which define the type of bus cycle operation 
being performed. Table 3-4 defines the bus 
cycles for the possible states of these signals. 
M/IO#, D/C# and W/R# are the primary bus 
cycle definition signals and are driven valid as 
ADS# (Address Status) becomes active. During 
non-pipelined cycles, the LOCK# output is 
driven valid along with M/IO#, D/C# and W/R#. 
During pipelined addressing, LOCK# is driven at 
the beginning of the bus cycle, which is after 
ADS# becomes active for that cycle. The bus 
cycle definition signals are active low and float 
while the Cx486SLC is in a hold acknowledge 
or float state. 



Table 3-3. Byte Enable Definitions 



BHE# 


BLE# 


FUNCTION 








Word transfer - D15-D0 





1 


Upper byte transfer - D15-D8 


1 





Lower byte transfer - D7-D0 


1 


1 


Never occurs during a bus cycle 
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Table 3-4. 


Bus Cycle Types 


M/IO# 


D/C# 


W/R# 


LOCK# 


BUS CYCLE TYPE 














Interrupt Acknowledge 











1 


-- 








1 


X 


-- 





1 


X 





-- 





1 





1 


I/O Data Read 





1 


1 


1 


VO Data Write 







X 





- 










1 


Memor/ Code Read 







1 


1 


Halt: A23-A1 = 2h, BHE# = 1 and BLE# = 
Shutdown: A23-A1 = Oh, BHE# = 1 and BLE# = 




1 








Locked Memory Data Read 




1 





1 


Memory Data Read 




1 


1 





Locked Memory Data Write 




1 


1 


1 


Memory Data Write 



X = don't care, 



= does not occur 



Memory/IO (M/IO#) distinguishes between 
memoiy and I/O operations. When high, this 
signal indicates that the cunrent bus cycle is a 
memoiy read or write. When low, M/IO# indi- 
cates that the current bus cycle is an I/O read or 
write. 

Data/Control (D/C#) distinguishes between 
data and control operations. When high, this 
signal indicates that the current bus cycle is a data 
transfer to or from memory or I/O. When low, 
D/C# indicates that the current bus cycle involves 
a control function such as halt, interrupt servicing 
or code fetch. 

Write/Read (W/R#) distinguishes between write 
and read bus cycles. When high, this signal 
indicates that the current bus cycle is a write to 
memory or I/O. When low, this signals indicates 
that the current bus cycle is a memory or I/O 
read operation. 



LOCK# is an active low output which, when 
asserted, indicates that other system bus masters 
are denied access to control of the system bus. 
The LOCK# signal may be explicitly activated 
during bus operations by including the LOCK 
prefix on certain instructions. LOCK# is always 
asserted during descriptor updates, interrupt 
ackhowledge sequences and when executing the 
XCHG instruction. The Cx486SLC does not 
enter the hold acknowledge state in response to 
HOLD while the LOCK# input is active. 

3.2.6 Bus Cycle Control 

The bus cycle control signals (ADS#, READY#, 
NA#) allow the Cx486SLC to indicate the begin- 
ning of a bus cycle and allow system hardware to 
control address pipelining and bus cycle termina- 
tion timing. 
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Address Strobe (ADS#) is an active low, three- 
state output which indicates that the Cx486SLC 
has driven a valid address (A23-A1, BHE#, BLE#) 
and bus cycle definition (M/IO#, D/C#, W/R#) on 
the appropriate Cx486SLC output pins. During 
non-pipelined bus cycles, ADS# is active for the 
first clock of the bus cycle. During address 
pipelining, ADS# is asserted during the previous 
bus cycle and remains asserted until REA.DY# is 
returned for that cycle. ADS# floats while the 
Cx486SLC is in a hold acknowledge state. 

Ready (READY#) is an active low input which is 
driven by the system hardware to indicate that 
the current bus cycle can be terminated. During 
a read cycle, assertion of READY# indicates that 
the system hardware has presented valid data to 
the CPU. When READY# is sampled active, the 
Cx486SLC latches the input data and terminates 
the cycle. During a write cycle, READY# asser- 
tion indicates that the system hardware has 
accepted the Cx486SLC output data. READY# 
must be asserted to terminate every bus cycle, 
including halt and shutdown indication cycles. 

Next Address Request (NA#) is an active low 
input used to request address pipelining. Asser- 
tion of this input by the system hardware indi- 
cates it is prepared to accept new bus cycle 
definition and address signals (M/IO#, D/C#, 
W/R#, A23-A1, BHE#, and BLE#) from the 
microprocessor even if the current bus cycle has 
not been terminated by assertion of READY#. 
If the Cx486SLC has an internal bus request 
pending and the NA# input is sampled active, the 
next bus definition and address signals are driven 
onto the bus. 

3.2.7 Interrupt Control 

The interrupt control input signals (INTR, NMI) 
allow the execution of the Cx486SLC's current 
instmction stream to be interrupted and suspended. 



Maskable Interrupt Request (INTR) is an 

active high level-sensitive input which causes the 
processor to suspend execution of the current 
instruction stream and begin execution of an 
interrupt service routine . The INTR input can be 
masked (ignored) through the Flags Register IF 
bit. When not masked, the Cx486SLC responds 
to the INTR input by performing two locked 
interrupt acknowledge bus cycles. The second 
interrupt acknowledge cycle reads an 8-bit value, 
the interrupt vector, from an external interrupt 
controller. The 8-bit interrupt vector indicates 
the interrupt level that caused generation of the 
INTR and is used by the CPU to determine the 
beginning address of the interrupt service rou- 
tine. To assure recognition of the INTR request, 
INTR must remain active until the start of the first 
interrupt acknowledge cycle. 

Non-maskable Interrupt Request (NMI) is a 

rising edge sensitive input which causes the 
processor to suspend execution of the current 
instmction stream and begin execution of an 
NMI interrupt service routine. The NMI inter- 
rupt service request cannot be masked by soft- 
ware. Asserting NMI causes an interrupt which 
internally supplies interrupt vector 2h to the CPU 
core. External interrupt acknowledge cycles are 
not necessary since the NMI interrupt vector is 
supplied internally. 

Once NMI processing has started, no additional 
NMIs are processed until after execution of the 
next IRET instruction (typically at the end of the 
NMI service routine). If NMI is re-asserted prior 
to execution of the IRET instruction, one and 
only one NMI rising edge is stored and is pro- 
cessed after execution of the next IRET. If an 
INTR occurs during the NMI service routine and 
INTR is unmasked, the INTR is serviced and 
execution returns to the NMI service routine 
following the next IRET. If a HALT instruction is 



3-6 



PRELIMINARY 



Signal Descriptions 



executed within the NMI service routine, the 
Cx486SLC restarts execution only in response to 
RESET or an unmasked INTR. NMI does not 
restart CPU execution under this condition. 

The Cx486SLC samples NMI at the beginning of 
each phase 2. To assure recognition, NMI must 
be inactive for at least eight CLK2 periods and 
then be active for at least eight CLK2 periods. 
Additionally, specified setup and hold times must 
be met to guarantee recognition at a particular 
clock edge. 

3.2.8 imternai Cieche 
iBiterfae® 

The internal cache interface signals (KEN#, 
FLUSH#, RPLSET, RPLVAL#) are used to indicate 
cache status and control caching activity. 

Cache Enable (KEN#) is an active low input 
which indicates that the data being returned 
during the current cycle is cacheable. When 
KEN# is active and the Cx486SLC is performing 
a cacheable code fetch or memory data read 
cycle, the cycle is transformed into a cache fill. 
Use of the KEN# input to control cacheability is 
optional. The non-cacheable region registers can 
also be used to control cacheability. Memory 
addresses specified by the non-cacheable region 
registers are not cacheable regardless of the state 
of KEN#. I/O accesses, locked reads and inter- 
rupt acknowledge cycles are never cached. 

During cached code fetches, two contiguous read 
cycles are performed to completely fill the 4-byte 
cache line. During cached data reads, the 
Cx486SLC performs only those bus cycles 
necessary to supply the required data to complete 
the current operation. Valid bits are maintained 
for each byte in the cache line, thus allov^ng data 
operands of less than 4 bytes to reside in the cache. 



During any cache fill cycle v^th KEN# asserted, 
the Cx486SLC ignores the state of the byte 
enables (BHE# and BLE#) and always writes two 
bytes of data into the cache. The KEN# input is 
ignored following reset and can be enabled using 
the KEN bit in the CCRO configuration register. 

Cache Flush (FLUSH#) is an active low input 
which invalidates (flushes) the entire cache. Use 
of FLUSH# to maintain cache coherency is 
optional. The cache may also be invalidated 
during each hold acknowledge cycle by setting 
the BARB bit in the CCRO configuration register. 
The FLUSH# input is ignored following reset and 
can be enabled using the FLUSH bit in the CCRO 
configuration register. 

Replacement Set (RPLSET) is an output 
indicating which set in the cache is currently 
undergoing a line replacement. This signal is 
meaningful only when the intemal cache is 
configured as two-way set associative. When the 
intemal cache is configured as direct-mapped, 
RPLSET=0 always. The RPLSET output is dis- 
abled (three-state) following reset and can be 
enabled using the RPL bit in the CCRl configura- 
tion register. 

Replacement Set Vahd (RPLVAL#) is an active 
low output driven during a cache fill cycle to 
indicate that RPLSET is valid for the current 
cycle. RPLVAL# and RPLSET provide external 
hardware the capability of monitoring the cache 
LRU replacement algorithm. The RPLVAL# 
output is disabled (three-state) foUov^ng reset 
and can be enabled using the RPL bit in the 
CCRl configuration register. 
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3.2.9 Address Bit 20 Mask 

Address Bit 20 Mask (A20M#) is an active low 
input which causes the Cx486SLC to mask (force 
low) physical address bit 20 when driving the 
external address bus or performing an internal 
cache access. When the processor is in real 
mode, asserting A20M# emulates the 1 MByte 
address wrap around that occurs on the 8086. ■ 
The A20 signal is never masked when paging is 
enabled regardless of the state of the A20M# 
input. The A20M# input is ignored following 
reset and can be enabled using the A20M bit in 
the CCRO configuration register. 

3.2. 1 @ Cc^gsrGsessGr Interface 

The data bus, address bus and bus cycle defini- 
tion signals, as well as the coprocessor interface 
signals (PEREQ, BUSY#, ERROR#), are used to 
control communication between the Cx486SLC 
and a coprocessor. Coprocessor or ESC opcodes 
are decoded by the Cx486SLC and the opcode 
and operands are then transferred to the copro- 
cessor via 1/0 port accesses to addresses 80 00F8h, 
80 OOFCh or 80 OOFEh. 80 00F8h functions as the 
control port address and 80 OOFCh and 80 OOFEh 
are used for operand transfers. Additional 
handshaking is provided using the three dedi- 
cated control signals described below. 

Coprocessor Request (PEREQ) is an active 
high input which indicates the coprocessor is 
ready to transfer data to or from the CPU. The 
coprocessor may assert PEREQ in the process of 
executing a coprocessor instruction. The 
Cx486SLC internally stores the current coproces- 
sor opcode and performs the correct data trans- 
fers to support coprocessor operations using 
PEREQ to synchronize the transfer of required 
operands. PEREQ is internally connected to a 



pull-down resistor to prevent this signal from 
floating active when left unconnected. 

Coprocessor Busy (BUSY#) is an active low 
input from the coprocessor which indicates to the 
Cx486SLC that the coprocessor is currently 
executing an instruction and is not yet able to 
accept another opcode. When the Cx486SLC 
processor encounters a WAIT instruction or any 
coprocessor instruction which operates on the 
coprocessor stack (e.g. load, pop, arithmetic 
operation), BUSY# is sampled. TheBUSY#is 
continually sampled and must be recognized as 
inactive before the CPU will supply the coproces- 
sor with another instruction. However, the 
following coprocessor instructions are allowed to 
execute even if BUSY# is active since these 
instructions are used for coprocessor initialization 
and exception clearing: 

FNINIT 

FNCLEX 
BUSY# is internally connected to a pull-up 
resistor to prevent it from floating active when left 
unconnected. 

Coprocessor Error (ERROR#) is an active low 
input used to indicate that the coprocessor 
generated an error during execution of a copro- 
cessor instruction. ERROR# is sampled by the 
Cx486SLC processor whenever a coprocessor 
instruction is executed. If ERROR# is sampled 
active, the processor generates exception 16 
which is then serviced by the exception handling 
software. 
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Certain coprocessor instructions do not generate 
an exception 16 even if ERROR# is active. These 
instructions, which involve clearing coprocessor 
error flags and saving the coprocessor state, are 
listed below: 

FNINIT 

FNCLEX 

FNSTSW 

FNSTCW 

FNSTENV 

FNSAVE 
ERROR# is internally connected to a pull-up 
resistor to prevent it from floating active when left 
unconnected. 

3.2o 1 1 Bus Arbitiraf i®ii 

The bus arbitration (HOLD, HLDA) signals allow 
the Cx486SLC to relinquish control of its local 
bus when requested by another bus master 
device. Once the processor has relinquished its 
bus (three-stated), the bus master device can then 
drive the local bus signals. 

Hold Request (HOLD) is an active high input 
used to indicate that another bus master requests 
control of the local bus. After recognizing the 
HOLD request and completing the current bus 
cycle or sequence of locked bus cycles, the 
Cx486SLC responds by floating (three-state) the 
local bus and asserting the Hold Acknowledge 
(HLDA) output. A23-A1, ADS#, BHE#, BLE#, 
D15-D0, D/C#, LOCK#, M/IO#, RPLSET, 
RPLVAL# and W/R# are floated while HLDA is 
asserted. 

Once HLDA is asserted, the bus remains granted 
to the requesting bus master until HOLD be- 



comes inactive. When the Cx486SLC recognizes 
HOLD is inactive, it simultaneously drives the ' 
local bus and drives HLDA inactive. External 
pull-up resistors may be required on some of the 
Cx486SLC tri-state outputs to guarantee that they 
remain inactive while in a hold acknowledge state. 
The HOLD input is not recognized while RESET 
is active. If HOLD is asserted while RESET is 
active, RESET has priority and the Cx486SLC 
places the bus into an idle state instead of a hold 
acknowledge state. The HOLD input is also 
recognized during suspend mode provided the 
CLK2 input has not been stopped. HOLD is 
level-sensitive and must meet specified setup and 
hold times for correct operation. 

Hold Acknowledge (HLDA) is an active high 
output which indicates that the Cx486SLC is in a 
hold acknowledge state and has relinquished 
control of its local bus. While in the hold ac- 
knowledge state, the Cx486SLC drives HLDA 
active and continues to drive SUSPA#. The other 
Cx486SLC outputs, A23-A1, ADS#, BHE#, BLE#, 
D15-D0, D/C#, LOCK#, M/IO#, RPLSET, 
RPLVAL# and W/R# are in a high-impedance 
state allowing the requesting bus master to drive 
these signals. If the on-chip cache can satisfy bus 
requests, the Cx486SLC continues to operate 
during hold acknowledge states. 

The processor deactivates HLDA when the 
HOLD request is driven inactive. The Cx486SLC 
stores one NMI rising edge during a hold acknow- 
ledge state for processing after HOLD is inactive. The 
FLUSH# input is also recognized during a hold 
acknowledge state. If SUSP# is asserted during a 
hold acknowledge state, the Cx486SLC may or 
may not enter suspend mode depending on the 
state of the internal execution pipeline. 
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Table 3-5 summarizes the state of the Cx486SLC 
output signals during hold acknowledge. 

Table 3-5. Signal States During Hold 
Acknowledge 





SIGNAL STATE DURING HOLD 
ACKNOWLEDGE 


A20M# 


Ignored 


A23-A1 


Float 


ADS# 


Float 


BHE#, BLE# 


Float 


BUSY# 


Ignored 


D15-D0 


Float 


D/C# 


Float 


ERROR# 


Ignored 


FLT# 


Input Recognized 


FLUSH# 


Input Recognized 


HLDA 


1 


HOLD 


Input Recognized 


INTR 


Ignored 


KEN# 


Ignored 


LOCK# 


Float 


Mno# 


Float 


NA# 


Ignored 


NMI 


Input Recognized 


PEREQ 


Ignored 


READY# 


Ignored 


RESET 


Input Recognized 


RPLSET 


Float 


RPLVAL# 


Float 


SUSP# 


Input Recognized 


SUSPA# 


Driven 


W/R# 


Float 



3.2.12 Power Mancigeinent 

The power management signals allows the 
Cx486SLC to enter suspend mode. Suspend 
mode can also be entered as the result of executing 



a HALT instruction. Suspend mode circuitry 
allows the Cx486SLC to consume minimal power 
while maintaining the entire internal CPU state. 

Suspend Request (SUSP#) is an active low 
input which requests that the Cx486SLC enter 
suspend mode. After recognizing SUSP# is active, 
the processor completes execution of the current 
instruction, any pending decoded instructions and 
associated bus cycles. In addition, the Cx486SLC 
waits for the coprocessor to indicate a not busy 
condition (BUSY# = 1) before entering suspend 
mode and asserting suspend acknowledge 
(SUSPA#). During suspend mode, internal 
clocks are stopped and only the logic associated 
with monitoring RESET, HOLD and FLUSH# 
remains active. With SUSPA# asserted, the CLK2 
input to the Cx486SLC can be stopped in either 
phase. Stopping the CLK2 input further reduces 
current consumption of the Cx486SLC. 

To resume operation, the CLK2 input is restarted 
(if stopped), followed by deassertion of the 
SUSP# input. The processor then resumes 
instruction fetching and begins execution in the 
instruction stream at the point it had stopped. 
The SUSP# input is level sensitive and must meet 
specified setup and hold times to be recognized at 
a particular clock edge. The SUSP# input is 
ignored following reset and can be enabled using 
the SUSP bit in the CCRO configuration register. 

The Suspend Acknowledge (SUSPA#) output 
indicates that the Cx486SLC has entered the 
suspend mode as a result of SUSP# assertion or 
execution of a HALT instruction. If SUSPA# is 
asserted and the CLK2 input is switching, the 
Cx486SLC continues to recognize FLT#, RESET, 
HOLD and FLUSH#. If suspend mode was 
entered as the result of a FiALT instruction, the 
Cx486SLC also continues to monitor the NMI 
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input and an unmasked INTR input. Detection of 
INTR or NMI forces the Cx486SLC to exit sus- 
pend mode and begin execution of the appropri- 
ate interrupt service routine. The CLK2 input to 
the processor may be stopped after SUSPA# has 
been asserted to further reduce the current 
consumption of the Cx486SLC. The SUSPA# 



output is disabled (floated) following reset and 
can be enabled using the SUSP bit in the GCRO 
configuration register. 

Table 3-6 shows the state of the Cx486SLC 
signals when the device is in suspend mode. 



fssbBe 3°@. SSgoBsaO Stsa&es (DyiTDDtig SimsooeoDoi M®eOe 



soGeyiAi. NAME 


SIGNAL STATE DUEIHNG SUSP# 
INITIATED SUSPEND MODE 


SIGNAL STATE DUI^ING HALT 
INITIATED SUSPEND MODE 


A20M# 


Ignored 


Ignored 


A23-A1 


1 


1 


ADS# 


1 


1 


BHE#, BLE# 








BUSY# 


Ignored 


Ignored 


D15-D0 


Float 


Float 


D/C# 


1 


1 


ERROR# 


Ignored 


Ignored 


FLT# 


Input Recognized 


Input Recognized 


FLUSH# 


Input Recognized 


Input Recognized 


HLDA 








HOLD 


Input Recognized 


Input Recognized 


INTR 


latched 


Input Recognized 


KEN# 


Ignored 


Ignored 


LOCK# 


1 


1 


M/IO# 








NA# 


Ignored 


Ignored 


NMI 


Ignored 


Input Recognized 


PEREQ 


Ignored 


Ignored 


READY# 


Ignored 


Ignored 


RESET 


Input Recognized 


Input Recognized 


RPLSET 


Driven 


Driven 


RPLVAL# 


Driven 


Driven 


SUSP# 


Input Recognized 


Ignored 


SUSPA# 


1 


1 


W/R# 
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3.2.1 3 Float Control (FLT#) 

Float (FLT#) is an active low input which forces 
all bidirectional and output signals to a tri-state 
condition. Floating the signals allows the 
Cx486SLC signals to be externally driven without 
physically removing the device from the circuit. 
The Cx486SLC CPU must be reset following 
assertion or deassertion of FLT#. It is recom- 
mended that FLT# be used only for test purposes. 

3.3 Functional Timing 

3.3.1 Reset Timing and 
internal Clock 
Synchronisation 

RESET is the highest priority input signal and is 
capable of interrupting any processor activity 
when it is asserted. When RESET is asserted, the 
Cx486SLC aborts any bus cycle. Idle, hold 
acknowledge and suspend states are also discon- 
tinued and the reset state is established. RESET is 
used when the Cx486SLC microprocessor is 
powered up to initialize the CPU to a known 



valid state and to synchronize the internal CPU 
clock with external clocks. 

RESET must be asserted for at least 15 CLK2 
periods to ensure recognition by the Cx486SLC 
microprocessor. If the self-test feature is to be 
invoked, RESET must be asserted for at least 80 
CLK2 periods. RESET pulses less than 15 CLK2 
periods may not have sufficient time to propagate 
throughout the Cx486SLC and may not be 
recognized. RESET pulses less than 80 CLK2 
periods followed by a self-test request may 
incorrectly report a self-test failure when no true 
failure exists. 

Provided the RESET falling edge meets specified 
setup and hold times, the internal processor clock 
phase is synchronized as illustrated in Figure 3-2. 
The internal processor clock is half the frequency 
of the CLK2 input and each CLK2 cycle corre- 
sponds to an internal CPU clock phase. Phase 2 
of the internal clock is defined to be the second 
rising edge of CLK2 following the falling edge of 
RESET. 



CLK2 [ ^ 


(t)2 OR (|)1 


(|)2 OR (t)l 
' \ 7 


<t)2 


(l)l 

^ \ 7 
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RESET 
Internal 


X 
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1707200 


Processor ><; 
/^i . 1 / \ 


xxxx 


XXXX 


X 


Clock 1 1 







Figure 3-2. Internal Processor Clock Synchronization 
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Following the falling edge of RESET (and after 
self-test if it was requested), the Cx486SLC 
microprocessor performs an internal initialization 
sequence for approximately 400 CLK2 periods. 
The Cx486SLC self-test feature is invoked if the 
BUSY# input is an active low state when RESET 
falls inactive. The self-test sequence requires 
approximately (2^° + 60) CLK2 periods to com- 
plete. Even if the self-test indicates a problem, the 
Cx486SLC microprocessor attempts to proceed 



with the reset sequence. Figure 3-3 illustrates the 
bus activity and timing during the Cx486SLC 
reset sequence. 

Upon completion of self-test, the FAX register 
contains 0000 OOOOh if the Cx486SLC micropro- 
cessor passed its internal self-test with no prob- 
lems detected. Any non-zero value in the FAX 
register indicates that the microprocessor is 
faulty. 
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EEEXSEEESES 



$ 1 lo 2 ol 



392 




*Approximately 



$2 



4)1 |<52 



Valid 1 



Valid 1 
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Figure 3-3. Bus Activity from HESE? until First Code Fetcii 



3-13 




Functional Timing 



3.3«2 Bus Operation 

The Cx486SLC microprocessor communicates 
with the external system through separate, 
parallel buses for data and address. This is 
commonly called a demultiplexed address/data 
bus. This demultiplexed bus eliminates the need 
for address latches required in multiplexed 
address/data bus configurations where the 
address and data are presented on the same pins 
at different times. 

Cx486SLC instructions can act on memory data 
operands consisting of 8-bit bytes, 16-bit words 
or 32-bit double words. The Cx486SLC bus 
architecture allows for bus transfers of these 
operands without restrictions on physical address 
alignment. Any byte boundary alignment is 
permissible. Operands not aligned on a word 
boundary may require more than one bus cycle 
to transfer the operand. This feature is transpar- 
ent to the programmer. 

The Cx486SLC data bus (D15-D0) is a 16-bit 
wide bidirectional bus. The Cx486SLC drives the 
data bus during write bus cycles and the external 
system hardware drives the data bus during read 
bus cycles. The address bus provides a 24-bit 
value using 23 signals for the 23 upper-order 
address bits (A23-A1), defining which 16-bit 
word is being accessed, and two byte enable 
signals (BHE# and BLE#) to directly indicate 
which of the two bytes within the word are active. 

Every bus cycle begins with the assertion of the 
address strobe (ADS#). ADS# indicates that the 
Cx486SLC has issued a new address and new bus 
cycle definition signals. A bus cycle is defined by 
four signals: M/IO#, W/R#, D/C# and LOCK#. 
M/10# defines if a memory or 1/0 operation is 
occurring, W/R# defines the cycle to be read or 



write, and D/C# indicates whether a data or 
control cycle is in effect. LOCK# indicates that 
the current cycle is a locked bus cycle. Every bus 
cycle completes when the system hardware 
returns READY# asserted. 

The Cx486SLC performs the following bus cycle 
types: 

Memory Read 
Locked Memory Read 
Memory Write 
Locked Memory Write 
I/O Read (or coprocessor read) 
I/O Write (or coprocessor write) 
Interrupt Acknowledge (always locked) 
Halt/Shutdown 
When the Cx486SLC microprocessor has no 
pending bus requests, the bus enters the idle 
state. There is no encoding of the idle state on 
the bus cycle definition signals, however, the idle 
state can be identified by the absence of further 
assertions of ADS# following a completed bus 
cycle. 

3.3.2.1 Bus Cycles using Non- 
Pipelined Addressing 

Non-Pipelined Bus States 

The shortest time unit of bus activity is a bus 
state, commonly called T states. A bus state is one 
internal processor clock period (two CLK2 
periods) in duration. A complete data transfer 
occurs during a bus cycle, composed of two or 
more bus states. 

The first state of a non-pipelined bus cycle is 
called TL During phase one (first CLK2) of Tl, 
the address bus and bus cycle definition signals 
are driven valid and, to signal their availability, 
address strobe (ADS#) is simultaneously asserted. 
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The second bus state of a non-pipelined cycle is 
called T2. T2 terminates a bus cycle with the 
assertion of the READY# input and valid data is 
either input or output depending on the bus 
cycle type. The fastest Cx486SLC microproces- 



sor bus cycle requires only these two bus states. 
READY# is ignored at the end of the Tl state. 

Three consecutive bus read cycles, each consist- 
ing of two bus states, are shown in Figure 3-4. 



CLK2 r 
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Fastest non-pipelined bus cycles consist of Tl and T2. 
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Figure 3-4. Fastest Non-Pipelined i^ead Cycles 
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Non-Pipelined Read and Write Cycles 

Any bus cycle may be performed with non- 
pipelined address timing. Figure 3-5 shows a 
mixture of read and write cycles with non- 
pipelined address timing. When a read cycle is 
performed, the Cx486SLC microprocessor floats 
its data bus and the externally addressed device 
then drives the data. The Cx486SLC micropro- 
cessor requires that all data bus pins be driven to 
a valid logic state (high or low) at the end of each 
read cycle, when READY# is asserted. When a 



read cycle is acknowledged by READY# asserted 
in the T2 bus state, the Cx486SLC CPU latches 
the information present at its data pins and 
terminates the cycle. 

When a write cycle is performed, the data bus is 
driven by the Cx486SLC CPU beginning in phase 
two of Tl . When a write cycle is acknowledged, 
the Cx486SLC vmte data remains valid through- 
out phase one of the next bus state to provide 
write data hold time. 



CLK2 r 
A23-A2 I- V- 


Idle 
Ti 


Cycl 

Non-Pi 

(W 

Tl 


el 

)elined 

rite) 

T2 


Cyc 

Non-Pi 

(Re 

Tl 


e2 

pelined 

ad) 

T2 


Cycle 3 

Non-Pipelined 

(Write) 

Tl T2 


Idle 
Ti 


Cycle 4 

Non-Pipelined 

(Read) 

Tl T2 


Idle 
Ti 




BHE#, BLE#, X 


xxxx 


X Valid 1 


)( Valid 2 


X Valid 3 


XXXX 


Y Valid 4 


XXXX 


M/iO#, D/C# 








\ 










X 




AXX 


W/R# V 


xxxx 


\ 


/ 


\ 




xxxx 






\ 


/ 




\ 






ADS# 




X 




/ 




NA# V 


xxxx 


xxxx 


XXXX 


XXXX 


XXXX 


xxxx 


xx)d 


xxxx 


XXXX 


xxxx 


XXXX 
























xxx 


READY# V 


xxxx 


xxxx 


xxx 


xxx 


xxx 


xxx 


xxx 


xxx 


xxxx 


xxx 








1 ' 
End Cycle 1 


End Cycle 2 


End Cycle 3 




End Cycle 4 


LOCK# Y 


xxxx 


X Valid 1 


Y Valid 2 


X Valid 3 


xxxx 


X Valid 4 


xxxx 


D15-D0 




















/ 


Out 1 \ — 


--(->-< 


Out 3 \— 


-<->- 


Note: Idle Slates 


are shown 


lere for dia 


gram varie 


y only. 










170470C 



Figure 3-5. Various Non-Pipelined Bus €ycles (no wait states) 
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Non-Pipelined Wait States 

Once a bus cycle begins, it continues until 
acknowledged by the external system hardware 
using the Cx486SLC READY# input. Acknowl- 
edging the bus cycle at the end of the first T2 
results in the shortest possible bus cycle, requir- 
ing only Tl and T2. If READY# is not immedi- 
ately asserted however, T2 states are repeated 
indefinitely until the READY# input is sampled 
active. These intermediate T2 states are referred 
to as wait states. If the external system hardware 
is not able to receive or deliver data in two bus 



states, it withholds the READY# signal and at least 
one wait state is added to the bus cycle. Thus, on 
an address by address basis the system is able to 
define how fast a bus cycle completes. 

Figure 3-6 illustrates non-pipelined bus cycles 
with one wait state added to cycles 2 and 3. 
READY# is sampled inactive at the end of the first 
T2 state in cycles 2 and 3. Therefore, the T2 state 
is repeated until READY# is sampled active at the 
end of the second T2 and the cycle is then 
terminated. The Cx486SLC ignores the READY# 
input at the end of the Tl state. 
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Initiating and Maintaining Non-Pipelined 
Cycles 

The bus states and transitions for non-pipelined 
addressing are illustrated in Figure 3-7. The bus 
transitions between four possible states: Tl, T2, 
Ti, and Th. Active bus cycles consist of Tl and 
T2 states, with T2 being repeated for wait states. 
Bus cycles always begin with a single Tl state. Tl 
is always followed by a T2 state. If a bus cycle is 
not acknowledged during a given T2 and NA# is 
inactive, T2 is repeated resulting in a wait state. 
When a cycle is acknowledged during T2, the 
following state is Tl of the next bus cycle if a bus 
request is pending internally. If no internal bus 
request is pending, the Ti state is entered. If the 
HOLD input is asserted and the Cx486SLC is 
ready to enter the hold acknowledge state, the Th 
state is entered. 

Due to the demultiplexed nature of the bus, the 
address pipelining option provides a mechanism 
for the external hardware to have an additional 
T state worth of access time without inserting a 
wait state. After the reset sequence and following 
any idle bus state, the processor always uses non- 
pipelined address timing. Pipelined or non- 
pipelined address timing is then determined on a 
cycle-by-cycle basis using the NA# input. When 
address pipelining is not used, the address and 
bus cycle definition remain valid during all wait 
states. When wait states are added and it is 
desirable to maintain non-pipelined address 
timing, it is necessary to negate NA# during each 
T2 state of the bus cycle except the last one. 

3.3.2«2 Bus Cycles using 

Pipelined Addressing 

The address pipelining option allows the system 
to request the address and bus cycle definition of 



the next internally pending bus cycle before the 
current bus cycle is acknowledged with READY# 
asserted. If address pipelining is used, the exter- 
nal system hardware has an extra T state of access 
time to transfer data. The address pipelining 
option is controlled on a cycle-by-cycle basis by 
the state of the NA# input. 

Pipelined Bus States 

Pipelined addressing is always initiated by assert- 
ing NA# during a non-pipelined bus cycle. 
Within the non-pipelined bus cycle, NA# is 
sampled at the beginning of phase 2 of each T2 
state and is only acknowledged by the Cx486SLC 
during wait states. When address pipelining is 
acknowledged, the address (BHE#, BLE#, and 
A23-A1) and bus cycle definition (W/R#, D/C#, 
and ]WIO#) of the next bus cycle are driven 
before the end of the non-pipelined cycle. The 
address status output (ADS#) is asserted simulta- 
neously to indicate validity of the above signals. 
Once in effect, address pipelining is maintained 
in successive bus cycles by continuing to assert 
NA# during the pipelined bus cycles. 

As in non-pipelined bus cycles, the fastest bus 
cycles using pipelined address require only two 
bus states. Figure 3-8 illustrates the fastest read 
cycles using pipelined address timing. The two 
bus states for pipelined addressing are TIP and 
T2P or TIP and T2I. The TIP state is entered 
following completion of the bus cycle in which 
the pipelined address and bus cycle definition 
information was made available and is the first 
bus state of every pipelined bus cycle. 

Within the pipelined bus cycle, NA# is sampled 
at the beginning of phase 2 of the TIP state. If 
the Cx486SLC has an internally pending bus 
request and NA# is asserted, the TIP state is 
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followed by a T2P state and the address and bus 
cycle definition for the next pending bus request 
is made available. If no pending bus request 
exists, the TIP state is followed by a T2I state 
regardless of the state of NA# and no new ad- 
dress or bus cycle information is driven. 



The pipelined bus cycle is terminated in either 
the T2P or T2I state with the assertion of the 
READY# input and valid data is either input or 
output depending on the bus cycle type. 
RMDY# is ignored at the end of the TIP state. 
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HOLD Negate! 
No Request 



HOLD Negai 
No Request 




Request Pending 
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HOLD Asserted 



READY#Asserted- 
HOLD Negated 
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READY# Asserted 
HOLD Negated 
Request Pending 



READY# Negated 
NA# Negated 



Bus States: 

Tl ~ First clock of a non-piplined bus cycle (CPU drives new address and asserts ADS#) 

T2 ~ Subsequent clocks of a bus cycle when NA# has not been sampled asserted in the current bus cycle. 

Ti -- Idle State 

Th - Hold Acknowledge (CPOU asserts HLDA) 

The fastest bus cycle consists of two states: Tl and T2 



Figure 3-7. Non-Pipelined Bus States 
PRELIMINARY 
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Fastest pipelined bus cycles consist of TIP and T2P. 



figure 3-8. Fastest Pipelined Read €ycles 



Pipelined Read and Write Cycles 

Any bus cycle may be performed with pipelined 
address timing. When a read cycle is performed, 
the Cx486SLC microprocessor floats its data bus 
and the externally addressed device then drives 
the data. When a read cycle is acknowledged by 
READY# asserted in either the T2P or T2I bus 
state, the Cx486SLC CPU latches the information 
present at its data pins and terminates the cycle. 

When a write cycle is performed, the data bus is 
driven by the Cx486SLC CPU beginning in phase 
two of TIP. When a write cycle is acknowledged, 
the Cx486SLC vmte data remains valid through- 
out phase one of the next bus state to provide 
write data hold time. 



Pipelined Wait States 

Once a pipelined bus cycle begins, it continues 
until acknowledged by the external system 
hardware using the Cx486SLC READY# input. 
Acknowledging the bus cycle at the end of the 
first T2P or T21 state results in the shortest 
possible pipelined bus cycle. If READY# is not 
immediately asserted, however, T2P or T21 states 
are repeated indefinitely until the READY# input 
is sampled active. Additional T2P or T21 states 
are referred to as wait states. 
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Figure 3-9 illustrates pipelined bus cycles with 
one wait state added to cycles 1 through 3. Cycle 
1 is a pipelined cycle with NA# asserted during 
TIP and a pending bus request. READY# is 
sampled inactive at the end of the first T2P state 
in cycle 1. Therefore, the T2P state is repeated 
until RMDY# is sampled active at the end of the 
second T2P and the cycle is then terminated. The 
Cx486SLC ignores the READY# input at the end 
of the TIP state. Note that ADS#, the address 
and the bus cycle definition signals for the 
pending bus cycle are all valid during each of the 
T2P states. Also, asserting NA# more than once 
during the cycle has no additional effects. Pipe- 
lined addressing can only output information for 
the very next bus cycle. 

Cycle 2 in Figure 3-9 illustrates a pipelined cycle, 
with one wait state, where NA# is not asserted 
until the second bus state in the cycle. In this 
case, the CPU enters the T2 state following TIP 
because NA# is not asserted. During the T2 state, 
the Cx486SLC samples NA# asserted. Because a 



bus request is pending internally and READY# is 
not active, the CPU enters the T2P state and 
asserts ADS#, valid address and bus cycle defini- 
tion information for the pending bus cycle. The 
cycle is then terminated by an active READY# at 
the end of the T2P state. 

Cycle 3 of Figure 3-9 illustrates the case where no 
internal bus request exists until the last state of a 
pipelined cycle with wait states. In cycle 3, NA# 
is asserted in TIP requesting the next address. 
Because the CPU does not have an internal bus 
request pending, the T2I state is entered. How- 
ever, by the end of the T2I state, a bus request 
exists. Because READY# is not asserted, a wait 
state is added. The CPU then enters the T2P state 
and asserts ADS#, valid address and bus cycle 
definition information for the pending bus cycle. 
As long as the CPU enters the T2P state at some 
point during the bus cycle, pipelined addressing 
is maintained. NA# need only be asserted once 
during the bus cycle to request pipeMed addressing. 
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Figure 3-9. Various Pipelined Cycles (one wait state) 
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Initiating and Maintaining Pipelined Cycles 

Pipelined addressing is always initiated by assert- 
ing NA# during a non-pipelined bus cycle with at 
least one wait state. The first bus cycle following 
RESET, an idle bus or a hold acknowledge state is 
always non-pipelined. Therefore, the Cx486SLC 
always issues at least one non-pipelined bus cycle 
following RESET, idle or hold acknowledge 
before pipelined addressing takes effect. 

Once a bus cycle is in progress and the current 
address has been valid for one entire bus state, 
the NA# input is sampled at the end of every 
phase one until the bus cycle is acknowledged. 



Functional Timing 



Once NA# is sampled active, the Cx486SLC 
microprocessor is free to drive a new address and 
bus cycle definition on the bus as early as the 
next bus state and as late as the last bus state in 
the cycle. 

Figure 3-10 illustrates the fastest transition 
possible to pipelined addressing following an idle 
bus state. In Cycle 1, the next address is driven 
during state T2P. Thus, Cycle 1 makes the 
transition to pipelined address timing, since it 
begins with Tl but ends with T2P. Because the 
address for Cycle 2 is available before Cycle 2 
begins, Cycle 2 is called a pipelined bus cycle and 
it begins with a TIP state. Cycle 2 begins as soon 
as READY# asserted terminates Cycle 1 . 
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Note: Following any idle bus state (Ti) the address is always non-pipelined and NA# is only sampled during wait states. 
To start address pipelining after an idle state requires a non-pipelined cycle witli at least one wait state 
(Cycle 1 above). The pipelined cycles (2, 3, and 4 above) are shown with various numbers of wait states. 17051CD 



Figure 3-10. Fastest Transition to Pipelined Address Following Idle Bus State 
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Figure 3-11 illustrates transitioning to pipelined 
addressing during a burst of bus cycles. Cycle 2 
makes the transition to pipelined addressing. 
Comparing Cycle 2 to Cycle 1 of Figure 3-10 
illustrates that a transition cycle is the same 
whenever it occurs consisting of at least Tl , T2 
(NA# is asserted at that time), and T2P (provided 



the Cx486SLC microprocessor has an internal 
bus request already pending). T2P states are 
repeated if wait states are added to the cycle. 
Cycles 2, 3, and 4 in Figure 3-11 show that once 
address pipelining is achieved it can be main- 
tained with two-state bus cycles consisting only of 
TlPandT2P. 
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Figure 3-11. Trcinsifiioning to Pipeiiiied Acfldress During Burst of Bus Cycles 
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Once a pipelined bus cycle is in progress, pipe- 
lined timing is maintained for the next cycle by 
asserting NA# and detecting that the Cx486SLC 
microprocessor enters T2P during the current 
bus cycle. The current bus cycle must end in 
state T2P for pipelining to be maintained in the 
next cycle. T2P is identified by the assertion of 
ADS#. Figures 3-10 and 3-11 each show 
pipelining ending after Cycle 4. This occurred 



because the Cx486SLC CPU did not have an 
internal bus request prior to the acknowledgment 
of Cycle 4. 

The complete bus state transition diagram, including 
operation with pipelined address is given in 
Figure 3-12. This is a superset of the diagram for 
non-pipelined address. The three additional bus 
states for pipelined address are shaded. 
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Tl - First dock of a non-pipelined bus cycle (CPU drives new address 

and asserts ADS#). 
T2 - Subsequent clocks of a bus cycle when NA# has not been sampled assertec 

in the current bus cycle. 
T2I - Subsequent clocks of a bus cycle when NA# has been sampled asserted in 

the current bus cycle but there is not yet an internal bus request pending 

(CPU does not drive new addess or assert ADS#). 
T2P - Subsequent clocks of a bus cycle when NA# has been sampled asserted in 

the current bus cycle and there is an internal bus request pending 

(CPU drives new address and asserts ADS#). 
TIP -- First clock of a pipelined bus cycle. 
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Figure 3-12. Complete Bus Stcetes 
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3.3.3 Locked Bus Cycles 

When the LOGK# signal is asserted the 
Cx486SLC microprocessor does not allow other 
bus master devices to gain control of the system 
bus. LOCK# is driven active in response to 
executing certain instructions with the LOCK 
prefix. The LOCK prefix allows indivisible 
read/modify/write operations on memory oper- 
ands. LOCK# is also active during Interrupt 
Acknowledge Cycles. 

LOCK# is activated on the CLK2 edge that begins 
the first locked bus cycle and is deactivated when 
READY# is returned at the end of the last locked 
bus cycle. When using non-pipelined addressing, 
LOCK# is asserted during phase 1 of TL When 
using pipelined addressing, LOCK# is driven 
valid during phase 1 of TIP. 

Figures 3-4 through 3-6 illustrate LOCK# timing 
during non-pipelined cycles and Figures 3-8 
through 3-11 cover the pipelined address case. 

3.3.4 Interrupt Acknowledge 
CINTA) Cycles 

The Cx486SLC microprocessor is interrupted by 
an external source via an input request on the 
INTR input (when interrupts are enabled). The 
Cx486SLC microprocessor responds with two 
locked interrupt acknowledge cycles. These bus 



cycles are similar to read cycles. Each cycle is 
terminated by READY# sampled active as shown 
in Figure 3-13. 

The state of A2 distinguishes the first and second 
interrupt acknowledge cycles. The address driven 
during the first interrupt acknowledge cycle is 
4h (A23-A3, Al, BLE# = 0; A2, BHE# = 1). The 
address driven during the second interrupt 
acknowledge cycle is Oh (A23-A1, BLE# = 0; 
BHE# = 1). 

To assure that the interrupt acknowledge cycles 
are executed indivisibly, the LOCK# output is 
asserted from the beginning of the first interrupt 
acknowledge cycle until the end of the second 
interrupt acknowledge cycle. Four idle bus states 
(Ti) are always inserted by the Cx486SLC micro- 
processor between the two interrupt acknowl- 
edge cycles. 

The interrupt vector is read at the end of the 
second interrupt cycle. The vector is read by the 
Cx486SLC microprocessor from D7-D0 of the 
data bus. The vector indicates the specific 
interrupt number (from 0-255) requiring service. 
Throughout the balance of the two interrupt 
cycles D15-D0 float. At the end of the first 
interrupt acknowledge cycle, any data presented 
to the Cx486SLC is ignored. 
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Interrupt Vector (0-255) is read on D7-D0 at end of second Interupt Acknowledge bus cycle. Because each 
Interrupt Acknowledge bus cycle is followed by idle bus states, asserting NA# has no practical effect. 
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3.3.5 Htelt and Shytdowii 
Cycles 

Halt Indication Cycle 

Executing the HLT instruction causes the 
Cx486SLC execution unit to cease operation. 
Signaling its entrance into the halt state, a halt 
indication cycle is performed. The halt indication 
cycle is identified by the state of the bus cycle 
definition signals (M/I0#=1, D/C#=0, W/R#=l, 



LOCK#=l) and an address of 2h (A23-A2=0, 
Al=l, BHE#=1, BLE#=0). The halt indication 
cycle must be acknowledged by READY# as- 
serted. A halted Cx486SLC microprocessor 
resumes execution when INTR (if interrupts are 
enabled), NMI, or RESET is asserted. Figure 3-14 
illustrates a non-pipelined halt cycle. 
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Figure 3- 1 4. Non-pipelined Holt Cycle 



Shutdown Indication Cycle 

Shutdown occurs when a severe error is detected 
that prevents further processing. The Cx486SLC 
microprocessor shuts down as a result of a 
protection fault while attempting, to process a 
double fault as well as the conditions referenced 
in Chapter 2. Signaling its entrance into the 
shutdowni state, a shutdown indication cycle is 
performed. The shutdown indication cycle is 



identified by the state of the bus cycle definition 
signals (M/I0#=1, D/C#=0, W/R#=l, L0CK=1) 
and an address of Oh (A23-A1 = 0, BHE# = 1, 
BLE#=0). The shutdovvni indication cycle must 
be acknowledged by READY# asserted. A shut 
dov^ni Cx486SLC microprocessor resumes 
execution only when NMI or RESET is asserted. 
Figure 3-15 illustrates a shutdown cycle using 
pipelined addressing. 
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Figure 3- 1 5* Pipelined Shufdovm Cycle 



3.3.6 Internal Cache Interface 

3.3.6.1 Cache Fills 

Any unlocked memory read cycle can be cached 
by the Cx486SLC. The Cx486SLC automatically 
does not cache accesses to memory addresses 
specified by the non-cacheable region registers. 
Additionally, the KEN# input can be used to 
enable caching of memory accesses on a cycle-by- 
cycle basis. The Cx486SLC acknowledges the 
KEN# input only if the KEN enable bit is set in 
the CCRO configuration register. 



As shown in Figures 3-16 and 3-17, the 
Cx486SLC samples the KEN# input one CLK2 
before READY# is sampled active. IfKEN#is 
asserted and the current address is not set as non- 
cacheable per the non-cacheable region registers, 
then the Cx486SLC fills two bytes of a line in the 
cache with the data present on the data bus pins. 
The states of BHE# and BLE# are ignored if 
KEN# is asserted for the cycle. 

If the RPL bit in the CCRl configuration register 
is set, then the RPLSET and RPLVAL# output 
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signals are driven by the Cx486SLC during cache 
fill cycles. If the cache is configured as direct- 
mapped (CO bit in CCRO configuration register), 
RPLSET is always driven low. If the cache is 
configured as two-way set associative, RPLSET 
indicates which set in the cache is undergoing a 
line replacement. RPLVAL# indicates that the 
Cx486SLC will perform a cache fill to the indi- 
cated set with the data present on the data bus 
pins at the time READY# is sampled active. 
However, if KEN# is enabled and sampled 



inactive, the data is not cached and the line in the 
set indicated by RPLSET is not overwritten. 

Figures 3-16 and 3-17 illustrate RPLVAL# and 
RPLSET functional timing for both non-pipelined 
and pipelined cache fills. RPLVAL# is driven at 
the same time and for the same duration as the 
ADS# output for the cache fill cycle. RPLSET is 
driven one CLK2 after RPLVAL# is driven regard- 
less of whether or not the current bus cycle is 
pipelined. 
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i^igure 3-16. Non-Pipelined Gaciie Fills using KEN# 
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i^igure 3-1 7. Pipelined Cache Fills using iCEIi# 



3«3.6.2 Flushing the Cache 

To maintain cache coherency with external 
memor)^, the Cx486SLC cache contents should 
be invalidated when previously cached data is 
modified in external memory by another bus 
master. The Cx486SLC invalidates the internal 
cache contents during execution of the INVD and 
WBINVD instructions, following assertion of 
HLDA if the BARB bit is set in the CCRO configu- 
ration register, or following assertion of FLUSH# 
if the FLUSH bit is set in CCRO. 



The Cx486SLC samples the FLUSH# input on 
the risiQg edge of CLK2 corresponding to the begia- 
ning of phase 2 of the intemal processor clock. If 
FLUSH# is asserted, the Cx486SLC invalidates the 
entire contents of the intemal cache. The actual 
point in time where the cache is invalidated depends 
upon the internal state of the execution pipeline. 
FLUSH# must be asserted for at least two CLK2 
periods and must meet specified setup and hold 
times to be recognized on a specific CLK2 edge. 
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3.3.7 Address Bit 20 Masking 

The Cx486SLC internal cache addressing must be 
forced to emulate 8086 MByte wrap-around 
addressing, when system logic emulates the 
wrap-around addressing and data within the 64 
KByte wrap-around area resides in the Cx486SLC 
intemal cache. The Cx486SLC emulates the 
wrap-around addressing if the A20 bit is set in 
the CCRO configuration register and the A20M# 
input is asserted. Both the address bit 20 input to 
the intemal cache and the external A20 pin are 
masked (zeroed) when the A20M# input is asserted. 



As shown in Figure 3-18 , the Cx486SLC samples 
the A20M# input on the rising edge of CLK2 
corresponding to the beginning of phase 2 of the 
intemal processor clock. If A20M# is asserted 
and paging is not enabled, the Cx486SLC masks 
the A20 signal intemally starting with the next 
cache access and externally starting with the next 
bus cycle. If paging is enabled, the A20 signal is 
not masked regardless of the state of A20M#. 
A20 remains masked until the access following 
detection of an inactive state on the A20M# pin. 
A20M# must be asserted for a minimum of two 
CLK2 periods and must meet specified setup and 
hold times to be recognized on a specific CLK2 edge. 
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Figure 3-18. Masking A20 using A20M# During Burst of Bus C/cles 
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An alternative to using the A20M# pin is provided 
by the NCO bit in the CCRO configuration register. 
The Cx486SLC automatically does not cache 
accesses to the first 64 KBytes and to 1 MByte + 64 
KBytes if the NCO bit is set. This prevents data 
within the wrap-around memory area from resid- 
ing in the internal cache and thus eliminates the 
need for masking A20 to the internal cache. 

3.3.8 Held Ackn^wleilge State 

The hold acknowledge state provides the mecha- 
nism for an external device in a Cx486SLC 
system to acquire the Cx486SLC system bus 
while the Cx486SLC is held in an inactive bus 
state. This allows external "bus masters" to take 
control of the Cx486SLC bus and directly access 
system hardware in a shared manner with 
the Cx486SLC. The Cx486SLC continues to 
execute instructions out of the cache (if enabled) 
until a system bus cycle is required. 

The hold acknowledge state (Th) is entered in 
response to assertion of the HOLD input. In the 
hold acknowledge state, the Cx486SLC micro- 
processor floats all output and bi-directional 
signals, except for HLDA and SUSPA#. HLDA is 
asserted as long as the Cx486SLC CPU remains 
in the hold acknowledge state and all inputs 
except HOLD, FLUSH#, FLT#, SUSP# and RESET 
are ignored. 



Th may be entered directly from a bus idle state, 
as in Figure 3-19, or after the completion of the 
current physical bus cycle if the LOCK# signal is 
not asserted, as in Figures 3-20 and 3-2 L The 
CPU samples the HOLD input on the rising edge 
of CLK2 corresponding to the beginning of phase 1 
of the internal processor clock. HOLD must 
meet specified setup and hold times to be recog- 
nized at a given CLK2 edge. 

The hold acknowledge state is exited in response 
to the HOLD input being negated. The next bus 
state is an idle state (Ti) if no bus request is 
pending, as in Figure 3-19. If a bus request is 
internally pending, as in Figures 3-20 and 3-21, 
the next bus state is Tl . Th is also exited in 
response to RESET being asserted. If HOLD 
remains asserted when RESET goes inactive, the 
Cx486SLC enters the hold acknowledge state 
before performing any bus cycles provided 
HOLD is still asserted when the CPU is ready to 
perform its first bus cycle. 

If a rising edge occurs on the edge-triggered NMI 
input while in the Th state, the event is remem- 
bered as a non-maskable interrupt 2 and is 
serviced when" the Th state is exited. 
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CLK2 [ 

HOLD [ 

HLDA [ 

A23-A1,BHE#, r- 
BLE#, D/C#, 

M/IO#, W/R# ^ 

ADS# [ 

NA# [ 

READY# [ 



LOCK# [ X! 
D15-D0 [ - 



Idle 



.^^ 



Hold Acknowledge 



Th 



Th 



(Floating) 
(Floating) 



Th 



(Floating) 
(Floating) 



Note: For maximum design flexibility the CPU has no internal pull-up resistors on its outputs. 
External pull-ups may be required on ADS# and other outputs to keep them negated 
during hold acknowledge period. 



Idle 



Figure 3- 1 9. Requesting Hold from Idle Bus State 
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Cycle 1 


Hold 


Non-Pipelined 


Acknowledge 


(Read) 





Cycle 2 

Non-Pipelined 

(Write) 



CLK2 [ 
HOLD [ 
HLDA [ 



A23-A1,BHE#,BLE#, r- . 

BLE#,D/C#, L 
M/IO#, W/R# 



><C 



ADS# [ 



LOCK# [ 



D15-D0 \2 



Tl 



T2 



T2 



Valid 1 



READY# [ 



Th 



Th 



HOLD asserted no later 
than READY* asserted 



(Negated, or Last Locked Cycle) 



Valid 1 



_(Flqatin^__ 



(Floating) 



(Floating) 



X><XXX XXXX><XXX>^XXXXXXX 



xxxxxxxx ><xx\ xxxxxxx>^xxxxxxx 



> 



<Inl> ^- 

(Floating) 



(Floating) 



Tl 



T2 



Valid 2 



Valid 2 



Out 2 



Note: HOLD is a synchronous input and can be asserted at any CLK2 edge, provided setup and hold 
requirements are met. This waveform is useful for determining Hold Acknowledge latency. 



Figure 3-20. Requesting Hold from Active Non-Pipelined Bus 
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Cycle 1 
Pipelined 
(Write) 



Hold 


Cycle 2 


Acknowledge 


Non-Pipelined 




(Read) 



CLK2 [ 
HOLD [ 
HLDA [ 



A23-A1, BHE#, 
BLE#, D/C#, 
M/IO#,W/R# L 



ADS# [ 
READY# r 



V 



Valid 1 



T2I 



HOLD asserted in same bu 
state as NA# asserted. 



Th 



:xxxExxxx> — -----^^ — 



^ 



(Negated, or Last-Locked Cycle) 



[ 



K 



Valid 1 



D15-D0 [] Out 



Th 



(Floating; 



(Floating^ 



(Floating^ 



Outl 



>- 



(Floating) 



T2 



Valid 2 



Valid 2 



<In2 



Note: HOLD is a synchronous input and can be asserted at any CLK2 edge, provided setup and hold requirements are met. 
This waveform is useful for determining Hold Acknowledge latency. 



Figuire 3-2 1 • Heeiuesf ieng Hoioi front Active Pipelined Bus 
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3.3.9 Coprocessor Interface 

The coprocessor interface consists of the data 
bus, address bus, bus cycle definition signals, and 
the coprocessor interface signals (BUSY#, 
ERROR# and PEREQ). The Cx486SLC auto- 
matically accesses dedicated coprocessor I/O 
addresses 80 OOFSh, 8000 FCh and 80 OOFEh to 
transfer opcodes and operands to/from the 
coprocessor whenever a coprocessor instruction 
is decoded. Coprocessor cycles can be either 
read or write and can be either non-pipelined or 
pipelined. Coprocessor cycles must be termi- 
nated by READY# and, as with any other bus 
cycle, can be terminated as early as the second 
bus state of the cycle. 

BUSY#, ERROR# and PEREQ are asynchronous 
level-sensitive inputs used to synchronize CPU 
and coprocessor operation. All three signals are 
sampled at the beginning of phase 1 and must 
meet specified setup and hold times to be recog- 
nized at a given CLK2 edge. 

3«3. 1 Power Management 

SUSP# Initiated Suspend Mode 

The Cx486SLC enters suspend mode when the 
SUSP# input is asserted and execution of the 
current instruction, any pending decoded in- 
structions and associated bus cycles are com- 
pleted. The Cx486SLC also waits for the 
coprocessor to indicate a not busy status 



(BUSY# = 1) prior to entering suspend mode. 
The SUSPA# output is then asserted. The 
Cx486SLC responds to SUSP# and asserts 
SUSPA# only if the SUSP bit is set in the CCRO 
configuration register. 

Figure 3-22 illustrates the Cx486SLC functional 
timing for SUSP# initiated suspend mode. SUSP# 
is sampled on the phase 2 CLK2 rising edge and 
must meet specified setup and hold times to be 
recognized at a particular CLK2 edge. The time 
from assertion of SUSP# to activation of SUSPA# 
varies depending on which instructions were 
decoded prior to assertion of SUSP#. The mini- 
mum time from SUSP# sampled active to 
SUSPA# asserted is 2 CLK2s. As a maximum, the 
Cx486SLC may execute up to two instructions 
and associated bus cycles prior to asserting 
SUSPA#. The time required for the Cx486SLC to 
deactivate SUSPA# once SUSP# has been 
sampled inactive is 4 CLK2s. 

If the Cx486SLC is in a hold acknowledge state 
and SUSP# is asserted, the processor may or may 
not enter suspend mode depending on the state 
of the Cx486SLC internal execution pipeline. If 
the Cx486SLC is in a SUSP# initiated suspend 
state and the CLK2 input is not stopped, the 
processor recognizes and acknowledges the 
HOLD input and stores the occurrence of 
FLUSH#, NMI and INTR (if enabled) for execu- 
tion once suspend mode is exited. 



PRELIMINARY 



3-37 



//f Advancing the Standards 



Functional Timing 



CLK2 [ 
SUSP# [ 



oi I 02 I oi I 02 I 01 I 02 




Figure 3-22. SUSP# initiated Suspend Mode 



HALT Initiated Suspend Mode 

The Cx486SLC also enters suspend mode as a 
result of executing a HALT instruction. The 
SUSPA# output is asserted no more than, 17 
CLK2s following READY# sampled active for the 
HALT bus cycle as shown in Figure 3-23. Sus- 
pend mode is then exited upon recognition of an 
NMl or an unmasked INTR. SUSPA# is deacti- 
vated 12 CLKZs after sampling of an active NMI 
or unmasked INTR. If the Cx486SLC is in a 
HALT initiated suspend mode and the CLK2 
input is not stopped, the processor recognizes 
and acknowledges the HOLD input and stores 
the occurrence of FLUSH# for execution once 
suspend mode is exited. 



Stopping the Input Clock 

Because the Cx486SLC is a static device, the 
input clock (CLK2) can be stopped and restarted 



without loss of any internal CPU data. CLK2 can 
be stopped in either phase 1 or phase 2 of the 
clock and either in a logic high or logic low state. 
However, entering suspend mode prior to stop- 
ping CLK2 dramatically reduces the CPU current 
requirements. Therefore, the recommended 
sequence for stopping CLK2 is to initiate 
Cx486SLC suspend mode, wait for assertion of 
SUSPA# by the processor and then stop the input 
clock. 

The Cx486SLC remains suspended until CLK2 is 
restarted and suspend mode is exited as de- 
scribed above. While CLK2 is stopped, the 
Cx486SLC can no longer sample and respond to 
any input stimulus including the HOLD, 
FLUSH#, NMI, INTR and RESET inputs. 
Figure 3-24 illustrates the recommended 
sequence for stopping CLK2 using SUSP# to 
initiate suspend mode. CLK2 should be stable for 
a minimum of 10 clock periods before SUSPA# is 
deasserted. 
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I0#, W/R#, r 
A1,BHE# L 



D/C#, A23-A2, 
BLE# 



[ 



READY# [ 

NMI [ 
SUSPA# [ 



Non-Pipelined HALT 
Tl I T2 



'XXXXXXtKXX^^XXE 



xxxxxx 




xxxxKx ^: 



XXXXXXXX)O^X)<^ 




Figure 3-23. Halt Initialed Suspend Made 



"tl I "Dl I <I)1 I (D2 I $1 



SUSP* [ A 



BUSY# [ 
SUSPA# [ 




Figure 3-24. Stopping CLiC2 During Suspend Mode 
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3.3.11 Float 

Activating the FLT# input floats all Cx486SLC 
microprocessor bi-directional and output signals. 
Asserting FLT# electrically isolates the Cx486SLC 
microprocessor from the surrounding circuitry. 
This feature is useful in board-level test environ- 
ments. As the Cx486SLC microprocessor is 
packaged in a surface mount PQFP, it is not 
usually socketed and cannot be removed from 
the motherboard when In-Circuit Emulation 
(ICE) is needed. Float capability allows connec- 
tion of an emulator by clamping the emulator 
probe onto the Cx486SLC microprocessor PQFP 
without removing it from the circuit board. 

FLT# is an asynchronous, active low input. It is 
recognized on the rising edge of CLK2. When 



recognized, it aborts the current bus state and 
floats the outputs of the Cx486SLC microproces- 
sor as shown in Figure 3-25. FLT# must be 
asserted for a minimum of 16 CLK2 cycles. To 
exit the float condition, RESET should be asserted 
and held asserted until after FLT# is deasserted. 

Asserting the FLT# input unconditionally aborts 
the current bus cycle and forces the Cx486SLC 
microprocessor into the float mode. As a result, 
the Cx486SLC microprocessor is not guaranteed 
to enter float in a valid state. After deactivating 
FLT#, the Cx486SLC CPU is not guaranteed to 
exit float in a valid state. The Cx486SLC micro- 
processor RESET input must be asserted prior to 
exiting float to guarantee that the Cx486SLC is 
reset and that it returns to a valid state. 



CLK2 



[ AAAAAAAAAAAAAAAAAAAAA/\ 



[~V 



f 



Control 



[ 



Valid 



c 



[ -0-C 



Valid 



i 



Address 



[ 



Valid 



Reset 



Figure 3-25. Entering and Exiting Float 
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ELEaRICM SPECIFICAHONS 
Electrical Connections 



Table 4- 1 • Pins Connected fio 
internal Puil-Up and Pull-Down Resistors 



Power and Ground Con- 
nections and Decoupling 

Due to the high frequency of operation of the 
Cx486SLC, it is necessary to install and test this 
device using standard high frequency techniques. 
The high clock frequencies used in the 
Cx486SLC and its output buffer circuits can 
cause transient power surges when several output 
buffers switch output levels simultaneously. 
These effects can be minimized by filtering the 
DC power leads with low-inductance decoupling 
capacitors, using low impedance Mdring, and by 
utilizing all of the 14 V^^ and 18 GND pins. 



4. 1 o2 Puii-Up/Pull-Down 
Resistors 

Table 4-1 lists the input pins which are internally 
connected to pull-up and pull-down resistors. 
The pull-up resistors are connected to V^^ and 
the pull-down resistors are connected to V^^. 
When unused, these inputs do not require 
connection to external pull-up or pull-down 
resistors. 



SIGNAL 


PIN 


RESISTOR 


A20M# 


31 


20-kQ pull-up 


BUSY# 


34 


20-kQ pull-up 


ERROR# 


36 


20-kQ pull-up 


FLT# 


28 


20-k^ pull-up 


FLUSH# 


30 


20-kn pull-up 


KEN# 


29 


20-ka pull-up 


PEREQ 


37 


20-kQ. pull-down 


SUSP# 


43 


20-kQ pull-up 



It is recommended that the ADS# and LOCK# 
output pins be connected to pull-up resistors, as 
indicated in Table 4-2. The external pull-ups 
guarantee that the signals will remain negated 
during hold acknowledge states. 

fable 4-2. Pins Requiring 

ixtemol Puii-yp Hesesiors 



SIGNAL 


PIN 


EXTERNAL RESISTOR 


ADS# 
LOCK# 


16 
26 


20-ka pull-up 
20-ka pull-up 
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4.1 .3 Unused Input Pins 

All inputs not used by the system designer and 
not listed in Table 4-1 should be connected either 
to ground or to V^^. Connect active-high inputs 
to ground through a 20 kQ (± 10%) pull-down 
resistor and active-low inputs to V^^ through a 
20 kQ (± 10%) pull-up resistor to prevent pos- 
sible spurious operation. 



4. 1.4 N/C Designated Pins 

Pins designated N/C should be left disconnected. 
Connecting an N/C pin to a pull-up resistor, pull- 
down resistor, or an active signal could cause 
unexpected results and possible circuit malfunc- 
tions. 



4.2 Absolute Maximum 
Ratings 

The following table lists absolute maximum 
ratings for the Cx486SLC and Cx486SLC-V 
microprocessors. Stresses beyond those listed 
under Table 4-3 limits may cause permanent 
damage to the device. These are stress ratings 
only and do not imply that operation under any 
conditions other than those listed under "Recom- 
mended Operating Conditions" (Table 4-4) is 
possible. Exposure to conditions beyond Table 
4-3 may (1) reduce device reliability and (2) 
result in premature failure even when there is no 
immediately apparent sign of failure. Prolonged 
exposure to conditions at or near the absolute 
maximum ratings (Table 4-3) may also result in 
reduced useful life and reliability. 





PARAMETER 


MIN 


MAX 


UNITS 


NOTES 


Case Temperature 


-65° 


+110° 


C 


Power Applied 


Storage Temperature 


-65° 


+150° 


c 


No Bias 


Supply Voltage, V^^ 


-0.5 


6.5 


V 


With Respect to V^g 


Voltage On Any Pin 


-0.5 


Vcc-0-5 


V 


With Respect to V^^ 


Input Clamp Current, I^^^ 




10 


mA 


Power Applied 


Output Clamp Current, I^^^ 




25 


mA 


Power Applied 
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4.3 Recommeiideci ®p®wm^m^ C^siditioi^s 

The following table presents the recommended operating conditions for the Cx486SLC and 
Cx486SLC-V devices. The Cx486SLC-V can be operated as a Cx486SLC. 

Table 4-4. Recommended Operating Conditions 



PARAMETER 


Cx486SLC 


CX486SI.C-V 


UNITS 


NOTES 


MIN 


MAX 


MIN 


MAX 


Tc 


Case Temperature 


0° 


+100° 


0° 


+85° 


C 


Power Applied 


\c 


Supply Voltage 


4.5 


5.5 


2.7 


3.6 


V 


With Respect to V^^ 


v,„ 


High Level Input 


2.0 


V,, + 0.3 


2.0 


Vcc + 0.3 


V 




V, 


Low Level Input 


-0.3 


0.8 


-0.3 


0.6 


V 




V„c 


CLK2 Input LOW 
Voltage 


-0.3 


0.8 


-0.3 


0.5 


V 




V,HC 


CLK2 Input HIGH 
Voltage 


3.7 


Vcc + 0-3 


Vcc-0.5 


Vcc^O.3 


V 




loH 


Output Current 
(High) 




-LO 




-1.0 


mA 


V =V 

OH OH(min) 


loL 


Output Current 
(Low) 




5.0 




3.0 


mA 


V =v 

OL OL(max) 


IlK 


Input Clamp 
Current 




+10 




+10 


mA 


V,.<V3sOr 

V,H>Vcc 


loK 


Output Clamp 
Current 




+25 




+25 


mA 


VouT<VssO'- 
VouT>Vcc 
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DC Characteristics 



Table 4-5. DC Characteristics (at Recommended Operating Conditions) 



PARAMETER 


Cx486SLC 


Cx486SLC-V 


UNITS 


NOTES 


MIN 


MAX 


MIN 


MAX 


Vq^ Output Low Voltage 
lQ^=3mA 




0.45 




0.35 


V 




Vqj^ Output High Voltage 
I,, = -0.2 mA 


2.4 
Vcc- 0.5 




Vcc- 0.4 
Vcc- 0.4 




V 




I^j Input Leakage Current 

For all pins except for those 
listed in Table 4- L ., 




±15 




±15 


MA 


o<v,,<v,. 


Ijj^ Input Leakage Current 
PEREQ 




200 




200 


I.A 


V,N=2.4 
Note 1 


\^ Input Leakage Current 

A20M#, BUSY#, ERROR#, FLT#, 
FLUSH#, KEN#, SUSP# 




-400 




-400 


|IA 


Vj^ = 0.45V 
Note 2 


I^^ Active I^^ 

20 MHz (CLK2 = 40 MHz) 
25 MHz (CLK2 = 50 MHz) 


Typical: 
380 
435 


500 
550 


Typical: 
175 
220 


230 
280 


mA 
mA 




^ccsM Suspend Mode ICC 

25 MHz (CLK2 = 50 MHz) 


Typical: 
5.0 


10.0 


Typical 
3.0 


6.0 


mA 


Note 3 


I^^3 Standby ICC 

MHz (Suspended/CLK2 Stopped) 


Typical: 
100 


250 


Typical: 
60 


150 


MA 


Note 3 


Cjj^ Input Capacitance 




10 




10 


pF 


f^ = 1 MHz (Note 4) 


Cq^j^ Output or I/O Capacitance 




12 




12 


PF 


f^ = 1 MHz (Note 4) 


C^^^ CLK2 Capacitance 




20 




20 


pF 


f^ = 1 MHz (Note 4) 



Notes: 1 . PEREQ input has an internal pull-down resistor. 

2. A20M#, BUSY#, ERROR#, FLT#, FLUSH#, KEN#, and SUSP# inputs each have an internal pull-up resistor. 

3. All inputs at 0.4 or V^^-0.4 (CMOS levels). All inputs held static, (except CLK2 as indicated). All outputs unloaded (static 1^^^^ = mA). 

4. Not 100% tested. 
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AC Characteristics 



Tables 4-7 and 4-8 list the AC characteristics 
including output delays, input setup require- 
ments, input hold requirements and output float 
delays. These measurements are based on the 
measurement points identified in Figures 4-1 
and 4-2. The rising clock edge reference level 
V^P^, and other reference levels are shown in 
Table 4-6 below for the Cx486SLC and 
Cx486SLC-V. Input or output signals must cross 
these levels during testing. 

Figure 4-1 shows delay (A and B) and input setup 
and hold times (C and D). Input setup and hold 
times (C and D) are specified minimums, defining 
the smallest acceptable sampling window a 
synchronous input signal must be stable for 
correct operation. 



The outputs: A23-A1, ADS#, BHE#, BLE#, D/C#, 
HLDA, LOCK#, M/IO#, RPLVAL#, and W/R# 
change only at the beginning of phase one 
(Figure 4-1). D15-D0 (write cycles), RPLSET 
and SUSPA# change at the beginning of phase two. 

The inputs: BUSY#, D15-D0 (read cycles), 
ERROR#, FLT#, HOLD, PEREQ, and READY# 
are sampled at the beginning of phase one 
(Figure 4-1). A20M#, FLUSH#, INTR, KEN#, 
NA#, NMI, and SUSP# are sampled at the begin- 
ning of phase two. 



Table 4-6. JMeosureitient Points for Switching Characteristics 



SYMBOL 


C2C486SLC 


Cx486SLC-V 


UHITS 


V 

''refc 


2 


1.5 


V 


Vkb. 


1.5 


1.2 


V 


V,„c 


V,^- 0.8 


Vcc-0-5 


V 


V„c 


0.8 


0.6 


V 


V 


3 


2.3 


V 


V.O 








V 
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Tx 



CLK2: 

OUTPUTS: 
A23-A1,ADS#, BHE#, 



BLE#, D/C, HLDA, Valid 
LOCK#, M/IO#, Output 
RPLVAL#, W/R# 



OUTPUTS: 

D15-D0, RPLSET, 
SUSPA# 



INPUTS: 

A20M#, FLUSH#, 

INTR, KEN#, 

NA#, NMI#, SUSP# 

INPUTS: 

BUSY#, D15-D0, 

ERROR#, FLT#, HOLD, 

PEREQ, READY# 



«^(bH min 



MAX 



Valid 
Output n+ 1 



Valid 
Output 



^{B^MIN 



MAX 



Valid 
Output n+1 



Mg>- 



1 



Valid 
Input 



1 



% ^ ^ ^~f/ 



LEGEND: A - Maximum Output Delay Specification 
B - Minimum Output Delay Specification 
C - Minimum Input Setup Specification 
D - Minimum Input Hold Specification 



Figure 4-1 • Drive Level and Measurement Points for Switclting Ciiaracterisrics 
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Figure 4-2. CLiC2 Timing Measurement Points 
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Table 4-7. AC Charaderisrics for Cx486SLC-V20 

Cx486SLC-V20: V,, = 2.7 to 3.6 V, T, = 0° to 85°C 



SYMBOL 


PARAMETER 


20MHZ 


FIGURE 


NOTES 


MIN 


MAX 






(nsl 


(nsl 






Tl 


CLK2 Period 


25 




4-2 


Notel 


T2a 


CLK2 High Time 


8 




4-2 


Note 2 


T2b 


CLK2 High Time 


5 




4-2 


Note 2 


T3a 


CLK2 Low Time 


8 




4-2 


Note 2 


T3b 


CLK2 Low Time 


6 




4-2 


Note 2 


T4 


CLK2 Fall Time 




8 


4-2 


Note 2 


T5 


CLK2 Rise Time 




8 


4-2 


Note 2 


T6 


A23-A1 Valid Delay 


4 


30 


4-4, 4-6 


q = 50pF 


T7 


A23-A1 Float Delay 


4 


32 


4-6 


Note 3, Note 6 


T8 


BHE#, BLE#, LOCK# Valid Delay 


4 


30 


4-4, 4-6 


q = 50 pF 


T9 


BHE#, BLE#, LOCK# Float Delay 


4 


32 


4-6 


Note 3 


TIO 


ADS#, D/C#, M/aO# 
RPLVAL#, W/R# Valid Delay 


4 


26 


4-4, 4-6 


q = 50pF 


Til 


ADS#, D/C#, W10#, RPLVAL#, 
W/R# Float Delay 


6 


30 


4-6 


Note 3 


T12 


D15-D0 Write Data, RPLSET, 
SUSPA# Valid Delay 


4 


38 


4-4, 4-5A 


q = 50 pF, Note 5 


T12A 


D15-D0 Write Data Hold Time 


4 




4-5B 




T13 


D15-D0 Write Data, RPLSET, 
SUSPA# Float Delay 


4 


27 


4-6 


Note 3 


T14 


HLDA Valid Delay 


4 


28 


4-6 


q = 50pF 


T15 


NA#, SUSP#, FLUSH#, KEN#, 
A20M# Setup Time 


5 




4-3 




T16 


NA#, SUSP#, FLUSH#, KEN#, 
A20M# Hold Time 


12 
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T19 


READY# Setup Time 


12 




4-3 




T20 


READY# Hold Time 


4 




4-3 




T21 


D15-D0 Read Data Setup Time 


9 




4-3 




T22 


D15-D0 Read Data Hold Time 


6 




4-3 




T23 


HOLD Setup Time 


17 




4-3 




T24 


HOLD Hold Time 


5 




4-3 




T25 


RESET Setup Time 


12 




4-7 




T26 


RESET Hold Time 


4 




4-7 




T27 


NMl, INTR Setup Time 


16 




4-3 


Note 4 


T28 


NMI, INTR Hold Time 


16 
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Note 4 


T29 


PEREQ, ERROR#, BUSY# 
Setup Time 


14 
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Note 4 


T30 


PEREQ, ERROR#, BUSY# 
Hold Time 


5 
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Table 4-8. AC Claaraefleristics for Cx486SLC-25, C3k486SLC-V25 

486SLC-25: V_ _ = 5.0 V ± 10%, T_ = 0° to 100°C 486SLC-V25: V_ _ = 2.7 to 3.6 V, T = 0° to 85° C 



SYMBOL 


PARAMETER 


25 MHz 


FIGURE 


NOTES 


MIN 


MAX 






(ns) 


(ns) 






Tl 


CLK2 Period 


20 




4-2 


Notel 


T2a 


CLK2 High Time 


7 




4-2 


Note 2 


T2b 


CLK2 High Time 


4 
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Note 2 


T3a 


CLK2 Low Time 


7 




4-2 


Note 2 


T3b 


CLK2 Low Time 


5 
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Note 2 


T4 


CLK2 Fall Time 




7 


4-2 


Note 2 


T5 


CLK2 Rise Time 




7 


4-2 


Note 2 


T6 


A23-A1 Valid Delay 


4 


21 


4-4, 4-6 


q = 50pF 


T7 


A23-A1 Float Delay 


4 


30 


4-6 


Note 3, Note 6 


T8 


BHE#, BLE#, LOCK# Valid Delay 


4 


21 


4-4, 4-6 


q = 50 pF 


T9 


BHE#, BLE#, LOCK# Float Delay 


4 


30 


4-6 


Note 3 


TIO 


ADS#, D/C#, M/IO#, 
RPLVAL#, W/R# Valid Delay 


4 


21 


4-4, 4-6 


q = 50pF 


Til 


ADS#, D/C#, M/IO#, 
RPLVAL#, W/R# Float Delay 


4 


30 


4-6 


Note 3 


T12 


D15-D0 Write Data, RPLSET, 
SUSPA# Valid Delay 


7 


27 


4-4, 4-5A 


q = 50 pF, Note 5 


T12a 


D15-D0 Write Data Hold Time 


2 
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T13 


D15-D0 Write Data, RPLSET, 
SUSPA# Float Delay 


4 


22 


4-6 


Note 3 


T14 


HLDA Valid Delay 


4 


22 


4-6 


q = 50pF 


T15 


NA#, SUSP#, FLUSH#, KEN#, 
A20M# Setup Time 


5 
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T16 


NA#, SUSP#, FLUSH#, KEN#, 
A20M# Hold Time 


3 
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T19 


READY# Setup Time 


9 
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T20 


READY# Hold Time 


4 
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T21 


D 1 5-DO Read Data Setup Time 


7 
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D15-D0 Read Data Hold Time 


5 
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T23 


HOLD Setup Time 


9 
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T24 


HOLD Hold Time 


3 
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T25 


RESET Setup Time 


8 
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T26 


RESET Hold Time 


3 
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T27 


NMI, INTR Setup Time 


6 
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T28 


NMI,INTR Hold Time 


6 
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T29 


PEREQ, ERROR#, BUSY# 
Setup Time 


6 
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T30 


PEREQ, ERROR#, BUSY# 
Hold Time 


5 
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AC Characteristics Notes: 

1. Input clock can be stopped, therefore minimum CLK2 frequency is MHz. 

2. These parameters are not tested. They are guaranteed by design characterization. 

3. Float condition occurs when maximum output current becomes less than Ij^, in magnitude. Float is not 100% tested. 

4. These inputs are allowed to be asynchronous to CLK2. The setup and hold specifications are given for testing purposes, to assure 
recognition within a specific CLK2 period. 

5. T12 minimum time is not 100% tested. 

6. SUSPA# floats only in response to activation of FLT#. SUSPA# does not float during a hold acknowledge state. 



CLK2 



READY# 



HOLD 



D15-D0 



PEREQ, ERROR#, 
FLT#, BUSY# 



NA#, SUSP#, FLUSH#, 
KEN#, A20M# 



NMI, INTR 




T19 >< T20 



UL 



T23- 



WEl 



-Tl^- 



T21- 



)mR 



-T22- 



umk 



-T29- 



)mR 



-T30 



3( 



-T15- 



S 



-T16- 



^( 



-T27- 



)mR 



-T28- 



)mR 



Figure 4-3. Input Signal Setup and Hold Timing 



4-10 



PRELIMINARY 



AC Characteristics 



CLK2 



BHE#, BLE#, 
LOCK# 

ADS#, 

D/C#,M/IO#, 

RPLVAL#, W/R# 



A23-A1 



D15-D0 (Write Data), 
RPLSET, SUSPA# 




T8- 



Validn )^ 



TIO- 



Valid 



T6- 



Valid 



MAX 



4 



Valid n+1 



^- ^mm 



MAX 



Valid n+1 



mimm. 



in- 



valid 



MAX 



Valid n+1 



MIN 



MAX 



D^^ 



Valid n+1 



Figure 4-4. Output Signal Valid Delay Timing 



CLK2 



W/R# 




J' 



T12-^ 



D15-D0 y/Z/Zi Valid 



MIN 



MAX 



Figure 4-5A. Dafla Write Cycle Valid Delay Timing 
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CLK2 _i 


01 02 


01 


1708700 


W/R# 


\ Validn+1 


T12a- 


^MIN 


PI =;.pO 


Validn X////X Validn+1 




1 1 



Figure 4-5B. Data Write Cycle Hold Timing 
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HLDA 


02 
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Figure 4-6. Output Signal Float Delay and HLDA Valid Delay Timing 
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)lor02 



CLK2 



RESET 




T26— ^ 



^ 



-T25- 



Initialization Sequence > 

01 or 02 02 (251 
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Figure 4-7. HESEf Setup and Held Timing 
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5. Mechanical Specifications 

5. 1 Pin Assignments 

The pin assignments for the Cx486SLC are shown in Figure 5-1. The signal names are shown in 
Table 5-1 sorted by pin numbers and in Table 5-2 sorted by signal names. 
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HLDA 
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.i 
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c 


4 








Vss 


c 


.) 








NA# 


c 


n 








READY# 


c 


/ 


Vcc 


c 


8 








Vcc 


c 


s^ 








Vcc 


c 


ID 








Vss 


c 


1 1 








Vss 


c 


12 








Vss 


c 


1.^ 








Vss 


c 


14 








CLK2 


c 


1") 








ADS# 


c 


Id 








BLE# 


c 


1 / 








Al 


c 


18 








BHE# 


c 


iw 








NC 


c 


10 








Vcc 


c 


21 








Vss 


c 


22 








M/IO# 


c 


2^ 








D/C# 


c 


24 








W/R# 


c 


2b 
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Figure 5-1. Pin Assignments 
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Table 5-1. Signal Names Sorted by Pin Number 



PIN 


SIGNAL 


PIN 


SIGNAL 


PIN 


SIGNAL 


PIN 


SIGNAL 


PIN 


SIGNAL 


NO. 


NAME 


NO. 


NAME 


NO. 


NAME 


NO. 


NAME 


NO. 


NAME 


1 


DO 


21 


Vcc 


41 


Vss 


61 


All 


81 


D15 


2 


Vss 


22 


Vss 


42 


Vcc 


62 


A12 


82 


D14 


3 


HLDA 


23 


M/IO# 


43 


SUSP* 


63 


Vss 


83 


D13 


4 


HOLD 


24 


D/C# 


44 


SUSPA* 


64 


A13 


84 


Vcc 


5 


Vss 


25 


W/R# 


45 


RPLSET 


65 


A14 


85 


Vss 


6 


NA# 


26 


LOCK# 


46 


RPLVAL* 


66 


A15 


86 


D12 


7 


READY* 


27 , 


N/C 


47 


N/C 


67 


Vss 


87 


Dll 


8 


Vcc 


28 


FLT# 


48 


Vcc 


68 


Vss 


88 


DIO 


9 


Vcc 


29 


KEN# 


49 


Vss 


69 


Vcc 


89 


D9 


10 


Vcc 


30 


FLUSH* 


50 


Vss 


70 


A16 


90 


D8 


11 


Vss 


31 


A20M# 


51 


A2 


71 


Vcc 


91 


Vcc 


12 


Vss 


32 


Vcc 


52 


A3 


72 


A17 


92 


D7 


13 


Vss 


33 


RESET 


53 


A4 


73 


A18 


93 


D6 


14 


Vss 


34 


BUSY* 


54 


A5 


74 


A19 


94 


D5 


15 


CLK2 


35 


Vss 


55 


A6 


75 


A20 


95 


D4 


16 


ADS# 


36 


ERROR* 


56 


A7 


76 


A21 


96 


D3 


17 


BLE# 


37 


PEREQ 


57 


Vcc 


77 


Vss 


97 


Vcc 


18 


Al 


38 


NMl 


58 


A8 


78 


Vss 


98 


Vss 


19 


BHE# 


39 


Vcc 


59 


A9 


79 


A22 


99 


D2 


20 


N/C 


40 


INTR 


60 


AlO 


80 


A23 


100 


Dl 



S'2, 
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Table 5-2. Pin Numbers Sorted by Signal Name 



SIGNAL 


PIN 


SIGNAL 


PIN 


SIGNAL 


PIN 


SIGNAL 


PIN 


SIGNAL 


PIN 


NAME 


NO. 


NAME 


NO. 


NAME 


NO. 


NAME 


NO. 


NAME 


NO. 


Al 


18 


A2r 


76 


Dll 


87 


PEREQ 


37 


Vcc 


97 


A2 


51 


A22 


79 


D12 


86 


READY# 


7 


Vss 


2 


A3 


52 


A23 


80 


D13 


83 


REShl 


33 


Vss 


5 


A4 


53 


ADS# 


16 


D14 


82 


RPLSET 


45 


•Vss 


11 


A5 


54 


A20M# 


31 


D15 


81 


RPLVAL# 


46 


Vss 


12 


A6 


55 


BHE# 


19 


D/C# 


24 


SUSP# 


43 


Vss 


13 


A7 


56 


BLE# 


17 


ERROR# 


36 


SUSPA# 


44 


Vss 


14 


A8 


58 


BUSY# 


34 


FLT# 


28 


Vcc 


8 


Vss 


22 


A9 


59 


CLK2 


15 


FLUSH# 


30 


Vcc 


9 


Vss 


35 


AlO 


60 


.DO 


1 


HOLD 


4 


Vcc 


10 


Vss 


41 


All 


61 


Dl 


100 


HLDA 


3 


Vcc 


21 


Vss 


49 


A12 


62 


D2 


99 


INTR 


40 


Vcc 


32 


Vss 


50 


A13 


64 


D3 


96 


KEN# 


29 


Vcc 


39 


Vss 


63 


A14 


65 


D4 


95 


LOCK# 


26 


Vcc 


42 


Vss 


67 


A15 


66 


D5 


94 


M/IO# 


23 


Vcc 


48 


Vss 


68 


A16 


70 


D6 


93 


NA# 


6 


Vcc 


57 


Vss 


77 


A17 


72 


D7 


92 


N/C 


20 


Vcc 


69 


Vss 


78 


A18 


73 


D8 


90 


N/C 


27 


Vcc 


71 


Vss 


85 


A19 


74 


D9 


89 


N/C 


47 


Vcc 


84 


Vss 


98 


A20 


75 


DIO 


88 


NMI 


38 


Vcc 


91 


W/R# 


25 
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5.2 Package Dimensions 



0.600 REF 
- (15.24) - 





TOP SIDE VIEW 




o5 

o ^. 
o o 

+1 +i 

00 fN 

o CI 



8g 

d Q 

8 CO 
ON (N 

d Ci 




0.170 ±0.010 
(4.32 +0.25/-0.26) 



(0.20) 



Note: All dimensions in inches (millimeters). 

*Note: For metal BQFP package only: 0.735 ± 0.003 (18.64 ± 0.08) 



TYP -^ ^ 0.025 TYP 



(0.635) 



0.020 MIN 
(0.51) 



Figure 5-2. 1 00-Pin Bumpered QFP Package Dimensions 
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5.3 



Thermal Characteristics 



The Cx486SLC is designed to operate when case temperature is between 0° - 100° C and between 
0° - 85° C for the Cx486SLC-V. The case temperature is measured on the top center of the package. 
The maximum die temperature (T. ) and the maximum ambient temperature (T. ) can be calcu- 
lated using the following equations. 



T = T + P X e 

J max c max jc 

T = T - P X e 

a max j max jc 



where; 



= Maximum average junction temperature (°C) 

= Case temperature at top center of package (°C) 

= Maximum device power dissipation (W) 

= Junction-to-case thermal resistance (°CAV) 

= Maximum ambient temperature (°C) 

= Average junction temperature (°C) 

= Junction-to-ambient thermal resistance (°CAV) 



Values for 9. and 6. are given in Table 5-3 for various airflows. 

ja JC o 



Table 5-3. Package Thermal Resistance and AirFlow 



AIRFLOW 
(FT/SEC) 


Thermal Resistance (°C/W| 


100-LEAD 
PLASTIC BQFP 


100-LEAD 
metal BQFP 


e 


% 


% 


% 





23 


2 


28 


2 


100 


21 


2 


25 


2 


250 


17 


2 


21 


2 


500 


13 


2 


16 


2 
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6. INSTRUCTION SET 

This section summarizes the Cx486SLC instruc- 
tion set and provides detailed information on the 
instruction encodings. All instructions are listed 
in the Instruction Set Summary Table 
(Table 6-16), which provides information on the 
instruction encoding, which flags are effected, 
and the instruction clock counts for each instruc- 
tion. The clock count values are based on the 
assumptions described in section 6.3. 



6.1 General Instruction 

Format 

All of the Cx486SLC machine instructions follow 
the general instruction format shown in Figure 
6-L These instructions vary in length and can 
start at any byte address. An instruction consists 
of one or more bytes that can include: prefix 
byte(s), at least one opcode byte(s), mod r/m 
byte, s-i-b byte, address displacement byte(s) and 
immediate data byte(s). An instruction can be as 
short as one byte and as long as 15 bytes. If there 
are more than 15 bytes in the instruction a 
general protection fault (error code of 0) is 
generated. 











e id32 16 1 8 none 
A J 


1 P P P P P P P P 1 T T T T T T T T Imod R R R r/m 1 ss 


index 


base_J d32 1 16 1 8 1 non 


7 07 076532076 


5 3 


2 




-^ V 

address 
displacement 
-y (4, 2, 1 bytes, 
or none) 


V V Y 
optional prefix byte(s) op-code mod r/m 
(one or two bytes) byte 


s-i-b 
byte 




V 

immediate 

data 

(4, 2, 1 bytes, 

or none) 

1703101 


P= -prefix bit ^, , , 
T = opcode bit register and address 

upcuucuu mode specifier 
R = opcode bit or reg bit ^ 





Figure 6- 1 • General Instruction Format 
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6.2 



Instruction Fields 



The general instruction format shows the larger 
fields that make up an instruction. Certain 
instructions have smaller encoding fields that 
vary according to the class of operation. These 



fields define information such as the direction of 
the operation, the size of the displacements, 
register encoding and sign extension. All the 
fields are described in Table 6-1 and the subse- 
quent paragraphs provide greater detail. 



Table 6- 1 • Instruction Fields 



FIELD NAME 


DESCRIPTION 


NUMBER OF BITS 


Prefix 


Specifies segment register override, address and operand size, repeat 
elements in string instruction, LOCK# assertion. 


8 per byte 


Opcode 


Identifies instruction operation. 


1 or 2 bytes 


w 


Specifies if data is byte or full size (full size is either 16 or 32 bits). 


1 


d 


Specifies direction of data operation. 


1 


s 


Specifies if an immediate data field must be sign-extended. 


1 


reg 


General register specifier. 


3 


mod r/m 


Address mode specifier. 


2 for mod; 3 for r/m 


ss 


Scale factor for scaled index address mode. 


2 


index 


General register to be used as index register. 


3 


base 


General register to be used as base register. 


2 


sreg2 


Segment register for CS, SS DS and ES. 


2 


sreg3 


Sigment register for CS, SS, DS ES FS and GS. 


3 


eee 


Control, debug and test register specifier. 


3 


Address 
displacement 


Address displacement operand. 


1, 2 or 4 bytes 


Immediate data 


Immediate data operand. 


1, 2 or 4 bytes 
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6.2. 1 Prefixes 

Prefix bytes can be placed in front of any instruc- 
tion. The prefix modifies the operation of the 
next instruction only. When more than one 
prefix is used, the order is not important. There 
are five type of prefixes as follows: 

1 . Segment Override explicitly specifies which 
segment register an instruction will use. 

2. Address Size switches between 16- and 
32-bit addressing. Selects the inverse of the 
default. 

3. Operand Size switches between 16- and 
32-bit addressing. Selects the inverse of the 
default. 



4. Repeat is used with a string instruction 
which causes the instruction to be repeated 
for each element of the string. 

5. Lock is used to assert the hardware LOCK# 
signal during execution of the instruction. 

Table 6-2 lists the encodings for each of the 
available prefix bytes. The operand size and 
address size prefixes allow the individual overrid- 
ing of the default value for operand size and 
effective address size. The presence of these 
prefixes select the opposite (non-default) oper- 
and size and/or effective address size as the case 
may be. 



Table 6-2. Instruction Prefix Summary 



PREFIX 


ENCODING 


DESCRIB»TION 


ES: 


26h 


Overide segment default, use ES for memory operand 


CS: 


2Eh 


Overide segment default, use CS for memory operand 


SS: 


36h 


Overide segment default, use SS for memory operand 


DS: 


3Eh 


Overide segment default, use DS for memory operand 


FS: 


64h 


Overide segment default, use FS for memory operand 


GS: 


65h 


Overide segment default, use GS for memory operand 


Operand Size 


66h 


Make operand size attribute the inverse of the default 


Address Size 


67h 


Make address size attribute the inverse of the default 


LOCK 


FOh 


Assert LOCK# hardware signal. 


REPNE 


F2h 


Repeat the following string instruction. 


REP/REPE 


F3h 


Repeat the following string instruction. 
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6.2.2 Opcode Field 

The opcode field is either one or two bytes in 
length and specifies the operation to be per- 
formed by the instruction. Some operations have 
more than one opcode, each specifying a differ- 
ent form of the operation. Some opcodes name 
instruction groups. For example, opcode 0x80 
names a group of operations that have an immediate 
operand, and a register or memory operand. The 



group opcodes use an opcode extension field of 3 
bits in the following byte, called the MOD R/M 
byte, to resolve the operation type. Opcodes for 
the entire Cx486SLC instruction set are listed in 
the Instruction Set Summary Table. The opcodes 
are given in hex values unless shown within 
brackets ([ ]). Values shown in brackets are 
binary values. 



6.2.3 w Field 

The 1-bit w field indicates the operand size during 16- and 32- bit data operations. 

Table 6-3. w Field Encoding 



vf Field 


OPEILAND S!Zi 
16-BIT DATA OPERATIONS 


OPERAND SIZE 
32-BIT DATA OPERATIONS 





8 Bits 


8 Bits 


1 


16 Bits 


32 Bits 



6.2.4 d Field 

The d field determines which operand is taken as the source operand and which operand is taken as 
the destination. 

Table 6-4. d Field Encoding 



d FIELD 


DIRECTION OF OPERATION 


SOURCE OPERAND 


DESTINATION OPERAND 





Register ~> Register/Memory 


reg 


mod r/m or 

mod ss-index-base 


1 


Register/Memory ~> Register 


mod r/m or 

mod ss-index-base 


reg 
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6.2«5 reg Field 

The reg field determines which general registers are to be used. The selected register is dependent on 
whether 16- or 32- bit operation is current and the status of the "w" bit. 

Table 6-5* reg Field Encoding 



reg 


16-BIT 
OPERATION 
w Field Not 

Present 


32-BIT 
OPERATION 
w Field Not 

Present 


16-BIT 

OPERATION 

w=0 


16-BIT 

OPERATION 

w=1 


32-BIT 

OPERATION 

w=0 


32-BIT 

OPERATION 

w=1 


000 


AX 


EAX 


AL 


AX 


AL 


EAX 


001 


CX 


ECX 


CL 


CX 


CL 


ECX 


010 


DX 


EDX 


DL 


DX 


DL 


EDX 


on 


BX 


EBX 


BL 


BX 


BL 


EBX 


100 


SP 


ESP 


AH 


SP 


AH 


ESP 


101 


BP 


EBP 


CH 


BP 


CH 


EBP 


no 


SI 


ESI 


DH 


SI 


DH 


ESI 


in 


DI 


EDI 


BH 


DI 


BH 


EDI 
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6.2.6 mod and r/m Fields 

The mod and r/m sub-fields, within the mod r/m 
byte, select the type of memory addressing to be 
used. Some instructions use a fixed addressing 
mode (e.g., PUSH or POP) and therefore, these 



fields are not present. Table 6-6 lists the address- 
ing method when 16-bit addressing is used and a 
mod r/m byte is present. Some mod r/m field 
encodings are dependent on the w field and are 
shown in Table 6-6A. 





Table 6-6. mod r/m Field Encoding 


mod r/m 


16-BIT ADDRESS MODE 
with mod r/m Byte 


32-BIT ADDRESS MODE 

with mod r/m Byte and 

No s-i-b Byte Present 


00 000 


DS:[BX+SI] 


DS:[EAX] 


00 001 


DS:[BX+DI] 


DS:[ECX] 


00 010 


SS:[BP+SI] 


DS:[EDX] 


00 011 


SS:[BP+DI] 


DS:[EBX] 


00 100 


DS:[SI] 


s-i-b is present (See 6.2.7) 


00 101 


DS:[DI] 


DS:[d32] 


00 110 


DS:[dl6] 


DS:[ESI] 


00 111 


DS:[BX] 


DS:[ED1] 








01000 


DS:[BX+Sl+d8] 


DS:[EAX+d8] 


01001 


DS:[BX+Dl+d8] 


DS:[ECX+d8] 


01010 


SS:[BP+SI+d8] 


DS:[EDX+d8] 


01011 


SS:[BP+DI+d8] 


DS:[EBX+d8] 


01 100 


DS:[SI+d8] 


s-i-b is present (See 6.2.7) 


01 101 


DS:[DI+d8] 


SS:[EBP+d8] 


01 no 


SS:[BP+d8] 


DS:[ESI+d8] 


01 111 


DS:[BX+d8] 


DS:[EDI+d8] 








10 000 


DS:[BX+SI+dl6] 


DS:[EAX+d32] 


10 001 


DS:[BX+DI+dl6] 


DS:[ECX+d32] 


10 010 


SS:[BP+SI+dl6] 


DS:[EDX+d32] 


10011 


SS:[BP+Dl+dl6] 


DS:[EBX+d32] 


10 100 


DS:[SI+dl6] 


s-i-b is present (See 6.2.7) 


10 101 


DS:[DI+dl6] 


SS:[EBP+d32] 


10 110 


SS:[BP+dl6] 


DS:[ESI+d32] 


10 111 


DS:[BX+dl6] 


DS:[EDI+d32] 








11000-11 111 


See Table 6-6A 


See Table 6-6A 
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Table 6-6A. mod r/m Field Encoding Dependent on w Field 



mod r/m 


16-BIT 

OPERATION 

w=0 


16-BIT 

OPERATION 

w=1 


32-BIT 

OPERATION 

w=0 


32-BIT 

OPERATION 

w=1 


11000 


AL 


AX 


AL 


EAX 


11001 


CL 


CX 


CL 


ECX 


11010 


DL 


DX 


DL 


EDX 


iioir 


BL 


BX 


BL 


EBX 


11100 


AH 


SP 


AH 


ESP 


11 101 


CH 


BP 


CH 


EBP 


11 no 


DH 


SI 


DH 


ESI 


11 111 


BH 


DI 


BH 


EDI 
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6.2.7 mod and base Fields 

In Table 6-6A, the note "s-i-b present" for certain 
entries forces the use of the mod and base field as 
listed in Table 6-7. 



Table 6-7. mod base Field Encoding 



mod base 


32-BIT ADDRESS MODE 
with mod r/m and 
s-i-b Bytes Present 


00 000 


DS:[EAX+(scaled index)] 


00 001 


DS:[ECX+(scaled index)] 


00 010 


DS:[EDX+(scaled index)] 


00 011 


DS:[EBX+(scaled index)] 


00 100 


SS:[ESP+(scaled index)] 


00101 


DS:[d32+(scaled index)] 


00 110 


DS:[ESI+(scaled index)] 


00 111 


DS:[EDI+(scaled index)] 






01000 


DS:[EAX+(scaled index)+d8] 


01001 


DS:[ECX+(scaled index)+d8] 


01010 


DS:[EDX+(scaled index)+d8] 


01011 


DS:[EBX+(scaled index)+d8] 


01 100 


SS:[ESP+(scaled index)+d8] 


01101 


SS:[EBP+(scaled index)+d8] 


01 no 


DS:[ESI+(scaled index)4-d8] 


01 111 


DS:[EDI+(scaled index)+d8] 






10 000 


DS:[EAX+(scaled index)+d32] 


10 001 


DS:[ECX+(scaled index)+d32] 


10 010 


DS:[EDX+(scaled index)+d32] 


10 011 


DS:[EBX+(scaled index)+d32] 


10 100 


SS:[ESP+(scaled index)+d32] 


10 101 


SS:[EBP+(scaled index)+d32] 


10 110 


DS:[ESl+(scaled index)+d32] 


10 111 


DS:[EDl+(scaled index)+d32] 



6.2.8 ss Field 

The ss field (Table 6-8) specifies the scale factor 
used in the offset mechanism for address calcula- 
tion. The scale factor multiplies the index value 
to provide one of the components used to 
calculate the offset address. 



Table 6-8. ss Field Encoding 



ss FIELD 


SCALE FACTOR 


00 


xl 


01 


x2 


10 


x4 


11 


x8 



6.2.9 index Field 

The index field (Table 6-9) specifies the index 
register used by the offset mechanism for offset 
address calculation. When no index register is 
used (index field = 100), the ss value must be 00 
or the effective address is undefined. 



Table 6-9. index Field Encoding 



index FIELD 


INDEX REGISTER 


000 


EAX 


001 


ECX 


010 


EDX 


on 


EBX 


100 


none 


101 


EBP 


no 


ESI 


111 


EDI 
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6»2o10 sreg2 Field 

The sreg2 field (Table 6-10) is a 2-bit field that 
allows one of the four 286-type segment registers 
to be specified. 



6.2.1 1 sregS Field 

The sreg3 field (Table 6-1 1) is 3-bit field that is 
similar to the sreg2 field, but allows use of the FS 
and GS segment registers. 



f eable 6- 1 0. sreg2 Field Encoding 



Toble 6-11. sreg3 Field Encoding 



sreg2 FIELD 


SEGMENT REGISTER SELECTED 


00 


ES 


01 


CS 


10 


SS 


11 


DS 



sreg3 FIELD 


SEGMENT REGISTER SELECTED 


000 


ES 


001 


CS 


010 


SS 


on 


DS 


100 


FS 


101 


GS 


no 


undefined 


ni 


undefined 



6.2.12 eee Field 

The eee field is used to select the control, debug and test registers as indicated in Table 6-12. The 
values shown in Table 6-12 are the only valid encodings for the eee bits. 

foiile6-12. eee Field Encoding 



eee FIELD 


REGISTER TYPE 


BASE REGISTER 


000 


Control Register 


CRO 


010 


Control Register 


• CR2 


on 


Control Register 


CR3 


000 


Debug Register 


DRO 


001 


Debug Register 


DRl 


010 


Debug Register 


DR2 


on 


Debug Register 


DR3 


no 


Debug Register 


DR6 


ni 


Debug Register 


DR7 


on 


Test Register 


TR3 


100 


Test Register 


TR4 


101 


Test Register 


TR5 


no 


Test Register 


TR6 


111 


Test Register 


TR7 
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Clock Counts 



The Instruction Set Summary Table lists nine flags 
that are affected by the execution of instuctions. 
The conventions shown in Table 6-13 are used to 
identify the different flags. Table 6-14 lists the 
conventions used to indicate what action the 
instuction has on the particular flag. 

Table 6- 1 3. Flag Abbreviations 



ABBREVIATION 


NAME OF FLAG 


OF 


Overflow Flag 


DF 


Direction Flag 


IF 


Interrupt Enable Flag 


TF 


Trap Flag 


SF 


Sign Flag 


ZF 


Zero Flag 


AF 


Auxiliary Flag 


PF 


Parity Flag 


CF 


Carry Flag 



Table 6- 1 4. Action of Instruction on Flag 



INSTUCTION 

TABLE 

SYMBOL 


ACTION 


X 


Flag is modified by the instruction. 


- 


Flag is not changed by the instruction. 





Flag is reset to "0". 


1 


Flag is set to"!". 



6.4.1 Assumptions 

The following assumptions have been made in 
presenting the clock count values for the 
individual instructions: 



1 . The instruction has been prefetched, 

decoded and is ready for execution. 

2. Bus cycles do not require wait states. 

3. There are no local bus HOLD requests 

delaying processor access to the bus. 

4. No exceptions are detected during instruc- 

tion execution. 

5. If an effective address is calculated, it does 
not use two general register components. 
One register, scaling and displacement can 
be used within the clock count shown. 
However, if the effective address calcula- 
tion uses two general register components, 
add 1 clock to the clock count shown. 

6. All clock counts assume aligned 16-bit 

memory/IO operands for cache miss 
counts. 

7. If instructions access a misaligned 16-bit 

operand or a 32-bit operand on even 
address, add 2 clocks for read or write and 
add 4 clock counts for read and write. 

8. If instructions access a 32-bit operand on 

odd addresses, add 4 clocks for read or 
write and add 8 clocks for read and write. 
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6.4.2 Abbreviations 



The clock counts listed in the Instruction Set Summary Table are grouped by operating mode and 
whether there is a register/cache hit or a cache miss. In some cases, more than one clock count is 
shown in a column for a given instruction, or a variable is used in the clock count. The abbreviations 
used for these conditions are listed in Table 6-15. 



Table 6-1 5. Clock Count Abbreviations 



CLOCK 
COUNT 
SYMBOL 


EXPLANATION 


/ 


Register operand/memoiy operand. 


n 


Number of times operation is repeated. 


L 


Level of the stack frame. 


1 


Condition jump taken | conditional jump not taken. 


\ 


CPL<IOPL\CPL>IOPL. 
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s 



I 





Tubled-ld 


. iitsti^yeticiii §@t Syinitaary 










INSTRUCTIION 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hift 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



1 AAA ASCII Adjust AL after Add 


1 3*^ 


------ X - X 


4 1 


1 4 1 11 J 




1 AAD ASCII Adjust AX before Divide 


1 D5 OA 


- - - - X X - X - 


4 1 


1 4 1 II 1 




1 AAM ASCII Adjust AX after Multiply 


1 D4 OA 


|----XX-X-| 


16 1 


1 16 1 II 1 




1 AAS ASCII Adjust AL after Subtract 


1 3F 


1 ------ X - X 1 


4 1 


1 4 1 II 1 






ADC Add with Carry 




X---XXXXX 










b 


h 


Register to Register 


l[OOdw][llregr/m] 




1 




1 


5 






Register to Memory 


1 [OOOw] [mod reg r/m] 




3 


■5 


3 


5 






Memory to Register 


1 [OOlw] [mod reg r/m] 




3 


5 


3 


5 






Immediate to Register/Memory 


8 [OOsw] [mod 010 r/m]# 




1/3 


5 


1/3 








Immediate to Accumulator 


l[010w]# 




1 




1 









ADD Integer Add 




X---XXXXX 










b 


h 


Register to Register 


0[00dw] [11 reg r/m] 




1 




1 


5 






Register to Memory 


0[000w] [mod reg r/m] 




3 


5 


3 


5 






Memory to Register 


[OOlw] [mod reg r/m] 




3 


5 


3 


5 






Immediate to Register/Memory 


8 [OOsw] [modOOOr/m]# 




1/3 


5 


1/3 








Immediate to Accumulator 


[OlOw] # 




1 




1 









AND Boolean AND 
Register to Register 
Register to Memory 
Memory to Register 
Immediate to Register/Memory 
Immediate to Accumulator 


2[00dw] [Uregr/m] 
2 [OOOw] [mod reg r/m] 
2 [OOlw] [mod reg r/m] 
8 [OOsw] [modlOOr/m]# 
2 [OlOw] # 


- - - X X - X 


1 
3 
3 

1/3 
1 


5 
5 
5 


1 
3 
3 
1/3 

1 


5 
5 
5 


b 


h 



ARPL Adjust Requested Privilege Level 
From Register/Memory 


63 [mod reg r/m] 


. . , . . X 






6/10 


10 


a 


h 



# = immediate data 
+ = 8-bit displacement 



■■ 16-bit displacement x = modified 

= 32-bit displacement (full) - = unchanged 



INSTRUCTION 


OPCODi 


py^Gs 


REAL 

MODE CLOC^ 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF T7 SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Mode 



BOUND Check Array Boundaries 
If Out of Range (Int 5) 
If In Range 



62 [mod reg r/m] 



11+int 
11 



11+int 
11 



b,e 



g>h,j,k,r 



BSF Scan Bit Forward 
Register/Memory, Register 


OF BC [mod reg r/m] 


X 


5/7+n 


9+n 


5/7+n 


9+n 


b 


h 



BSR Scan Bit Reverse 
Register/Memory, Register 


OF BC [mod reg r/m] 


X 


5/7+n 


9+n 


5/7+n 


9+n 


b 


h 






I 



0^ 



BSWAP Byte Swap 



OF C [1 reg] 



BT Test Bit 

Register/Memory, Immediate 
Register/Memory, Register 


OF BA [mod 100 r/m] # 
OF A3 [mod reg r/m] 


- - - - - - - - X 


3/4 
3/6 


5 
7 


3/4 
3/6 


5 
7 


b 


h 



BTC Test Bit and Complement 
Register/Memory, Immediate 
Register/Memory, Register 


OF BA[modlllr/m]# 
OF BB [mod reg r/m] 


- - - X 


4/5 
5/8 


6 
9 


4/5 
5/8 


6 
9 


b 


h 



BTR Test Bit and Reset 
Register/Memory, Immediate 
Register/Memory, Register 


OF BA[modllOr/m]# 
OF B3 [mod reg r/m] 


-------- X 


4/5 
5/8 


6 
9 


4/5 
5/8 


6 
9 


b 


h 



BTS Test Bit and Set 
Register/Memory 
Register (short form) 


OF BA [mod 101 r/m] 
OF AB [mod reg r/m] 


-------- X 


3/5 
4/7 


6 
8 


3/5 
4/7 


6 
8 


b 


h 



-- immediate data ++ = 16-bit displac 

= 8-bit displacement +++ = 32-bit displacement (full) 



= modified 
: unchanged 



I 



3 



INSTRUCITION 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF IF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Mode 



CAl T '^uhrnutine Cn\] 
















h,j,k,r 


Direct Within Segment 


E8 +++ 




7 




7 






Register/Memory Indirect Within Segment 


FF [modOlOr/m] 




8/9 


10 


8/9 


10 






Direct Intersegment 


9A [unsigned full offset, 




12 




30 








Call Gate to Same Privilege 


selector] 








41 


49 






Call Gate to Different Privilege No P 










83 


97 






Call Gate to Different Privilege P's 










81+4x 


95+4x 






16-bit Task to 16-bit TSS 










262 


263 






16-bit Task to 32-bit TSS 










293 


317 






16-bit Task to V86 Task 










179 


206 






32-bit Task to 16-bit TSS 










238 


258 






32-bit Task to 32-bit TSS 










296 


340 






32-bit Task to V86 Task 










182 


229 






Indirect Intersegment 


FF [modOllr/m] 




14 


17 


14 


34 






Call Gate to Same Privilege 










43 


51 






Call Gate to Different Privilege No P 










85 


99 






Call Gate to Different Privilege Level P's 










86+4x 


100+4X 






16-bit Task to 16-bit TSS 










267 


268 






16-bit Task to 32-bit TSS 










298 


322 






16-bit Task to V86 Task 










181 


211 






32-bit Task to 16-bit TSS 










243 


263 






32-bit Task to 32-bit TSS 










301 


345 






32-bit Task to V86 Task 










184 


230 







P = Parameters 



# = immediate data 
+ = 8-bit displacement 



■■ 16-bit displacement x = modified 

: 32-bit displacement (full) - = unchanged 



5? 















1 CLC Clear Carry Flag | F8 | | 1 | | 1 | | | | 




\CLD Clear Direction¥lag | FC | . ------- | 1 | | 1 | | | | 




|CLI Clear Interrupt Flag | FA | - - 1^1 1 '^ 1 1 1 ™ 1 









msimscfmu 


OPCOI^i 


PLAGS 


MOEIi CLOCK 
COUi^T 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


aeg/ 
Cache Hit 


Cache 
Miss 


aeg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



I CMC Complement the Carry Flag 



CMP Compare Integers 




X---XXXXX 










b 


h 


Register to Register 


3[10dw] [llregr/m] 




1 




1 








Register to Memory 


3 [lOlw] [modregr/m] 




3 


5 


3 


5 






Memory to Register 


3 [lOOw] [modregr/m] 




3 


5 


3 


5 






Immediate to Register/Memory, 


8[00sw] [modlllr/m]# 




1/3 


5 


1/3 


5 






Immediate to Accumulator 


3 [llOw] # 




1 




1 









CMPS Compare String 



A[011w] 



X X X X X 



CMPXCHG Compare and Exchange 

Registerl,Register2 

Memory, Register 


0FB[000w] [llreg2regl] 
OF B [OOOw] [mod reg r/m] 


X - - - X X X X X 


5 

7 


8 


5 
7 


8 







CWD Convert Word to Douhleword 



CWDE Convert Word to Douhleword 
Extended 


98 




3 




3 











1 DAA Decimal Adjust AL after Add 


h7 


[----xxxxxj 


4 1 


1 4 1 1 II 




1 DAS Decimal Adjust AL after Subtract 


hp 


1 - - - - X X X X X 1 


4 1 


1^1 II 1 



DEC Decrement by 1 
Register/Memory 
Register (short form) 


F[lllw] [mod 001 r/m] 
4 [1 reg] 


X---XXXX- 


1/3 
1 


5 


1/3 
1 


5 


b 


h 



m 



Dl\ Unsigned Divide 


F [01 Iw] [mod 110 r/m] 












b,e 


e,h 




Accumulator by Register/Memory 


















Divisor: Byte 






14/15 


17 


14/15 


17 






Word 






22/23 


24 


22/23 


24 






Doubleword 




. 


38/39 


40 


38/39 


40 







= immediate data 
= 8-bit displacement 



: 16-bit displac 

: 32-bit displacement (full) 



= modified 
: unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss J 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Mode 



J? 



ENTER Enter New Stack Frame 
Level = 
Level = 1 
Level (L) > 1 



C8 ++ [8-bit Level] 



7 

10 

6+4*L 



10 
6+4*L 



7 

10 

6+4*L 



10 
6+4*L 



HLT Halt 



IDIV Integer (Signed) Divide 














b,e 


e,h 




Accumulator by Register/Memory 


F[011w] [modlllr/m] 
















Divisor: Byte 






19/20 


22 


19/20 


22 






Word 






27/28 


29 


27/28 


29 






Doubleword 






43/44 


47 


43/44 


47 







IMUL Integer (Signed) Multiply 
Accumulator by Register/Memory 
Multiplier: Byte 
Word 


FlOllw] [modlOlr/m] 


X-------X 


3/5 
3/5 


7 
7 


3/5 
3/5 


7 
7 


b 


h 


Doubleword 






7/9 


13 


7/9 


13 






Register with Register/Memory 
Multiplier: Byte 
Word 


OF AF [mod reg r/m] 




3/5 
3/5 


7 
7 


3/5 
3/5 


7 
7 






Doubleword 






7/9 


13 


7/9 


13 






Register/Memory with Immediate to Register2 
Multiplier: Byte 
Word 


6[10sl] [mod reg r/m] # 




3/5 
3/5 


7 
7 


3/5 
3/5 


7 
7 






Doubleword 






7/9 


13 


7/9 


13 







IN Input from I/O Port 
Fixed Port 
Variable Port 



E [OlOw] [port number] 
E[110w] 



16 
16 



16 
16 



6\19 
6\19 



6\20 
6\20 



INC Increment hy 1 
Register/Memory 
Register (short form) 


F[lllw] [mod 000 r/m] 
4[0reg] 


X---XXXX- 


1/3 

1 


5 


1/3 

1 


5 


b 


h 



f = immediate data ■++ = 16-bit displacement x = modified 

• = 8-bit displacement +++ = 32-bit displacement (full) - = unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


MODE CLOCK 
COUNT 


NOTES 


OF DF IF IF SF ZF iU! PF CF 


Keg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Mode 



INS Input Stringfrom I/O Port 



6[110w] 



20 



6/19 



h, m 



3 

S 



I 



INT Software Interrupt 
INTi 


CD [i] 


- X ----- - 


14 


16 






b,e 


gj,k,r 


Protected Mode: 


















Interrupt or Trap to Same Privilege 
Interrupt or Trap to Different Privilege 
16-bit Task to 16-bit TSS by Task Gate 










57 
91 
265 


58 
92 
266 






16-bit Task to 32-bit TSS by Task Gate 










296 


320 






16-bit Task to V86 by Task Gate 










177 


205 






16-bit Task to 16-bit TSS by Task Gate 
32-bit Task to 32-bit TSS by Task Gate 










241 
299 


261 
343 






32-bit Task to V86 by Task Gate 










180 


232 






V86 to 16-bit TSS by Task Gate 










241 


261 






86 to 32-bit TSS by Task Gate 










299 


343 






86 to Privilege by Trap Gate/Int Gate 
INT 3 


CC 




14 


16 


106 


114 






Protected Mode: 


















Interrupt or Trap to Same Privilege 
Interrupt or Trap to Different Privilege 
16-bit Task to 16-bit TSS by Task Gate 










57 
91 
265 


58 
92 
266 






16-bit Task to 32-bit TSS by Task Gate 










296 


320 






16-bit Task to V86 by Task Gate 










177 


205 






32-bit Task to 16-bit TSS by Task Gate 










241 


261 






32-bit Task to 32-bit TSS by Task Gate 










299 


343 






32-bit Task to V86 by Task Gate 










180 


232 






V86 to 16-bit TSS by Task Gate 










241 


261 






V86 to 32-bit TSS by Task Gate 










299 


343 






V86 to Privilege by Trap Gate/lnt Gate 










106 


114 






Continued on the next page ... 



















# = immediate dau 
+ = 8-bit displ: 



= 16-bit displi 
-- 32-bit displ; 



modified 
inchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF IT SF ZF AIF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Mode 



INT Software Interrupt (Continued) 




- - X - - - - - 










b,e 


gO'k.r 


INTO 


CE 
















IfOF==0 






1 


1 


1 


1 






If 0F==1 (INT 4) 






15 


17 










Protected Mode: 


















Interrupt or Trap to Same Privilege 










57 


58 






Interrupt or Trap to Different Privilege 










91 


92 






16-bit Task to 16-bit TSS by Task Gate 










265 


266 






16-bit Task to 32-bit TSS by Task Gate 










296 


320 






16-bit Task to V86 by Task Gate 










177 


205 






32-bit Task to 16-bit TSS by Task Gate 










241 


261 






32-bit Task to 32-bit TSS by Task Gate 










299 


343 






32-bit Task to V86 by Task Gate 










180 


232 






V86 to 16-bit TSS by Task Gate 










241 


261 






V86 to 32-bit TSS by Task Gate 










299 


343 






V86 to Privilege by Trap Gate/Int Gate 










106 


114 







5? 



INVD Invalidate Cache 



I INVLPG Invalidate TLB Entry 



OF 01 [modlllr/m] 



IRET Interrupt Return 


CF 


xxxxxxxxx 












g,b,j,k,r 


Real Mode 






14 


14 










Protected Mode: 


















Within Task to Same Privilege 










35 


37 






Within Task to Different Privilege 










74 


78 






16-bit Task to 16-bit Task 










259 


260 






16-bit Task to 32-bit TSS 










290 


314 






16-bit Task to V86 Task 










173 


203 






32-bit Task to 16-bit TSS 










235 


255 






32-bit Task to 32-bit TSS 










295 


339 






32-bit Task to V86 Task 










176 


226 







= immediate 
= 8-bit displ: 



: 16-bit displacement 

■■ 32-bit displacement (full) 



modified 
: unchanged 



I 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF IF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



JB/JNAE/JC Jump on Below/Not Above or Equal/ 

Carry 

8-bit Displacement 

Full Displacement 


72 + 

OF 82+++ 




611 
611 




611 
611 






r 





JBE/JNA Jump on Below or Equal/Not Above 
8-bit Displacement 
Full Displacement 


76 + 

OF 86+++ 




6|1 
611 




611 
611 






r 





JCXZ Jump on CXZero 



E3 



713 



I 713 I 



3 



JE/JZ Jump on Equal/Zero 
8-bit Displacement 
Full Displacement 


74 + 

OF 84+++ 




611 
611 




611 
611 






r 





5 



JECXZ Jump on ECXZero 



713 



713 



JL/JNGE Jump on Less/Not Greater or Equal 
8-bit Displacement 
Full Displacement 


7C + 

OF 8C+++ 




611 
611 




611 
611 






r 





JLE/JNG Jump on Less or Equal/Not Greater 
8-bit Displacement 
Full Displacement 


7E + 

OF 8E+++ 




611 
611 




6il 
61 1 






r 





# = immediate da 
+ = 8-bit displace 



= 16-bit displacement 

= 32-bit displacement (full) 



: modified 
: unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF IT SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Mode 



JMP Unconditional Jump 














b 


h,j,k,r 




Short 


EB + 




6 




6 








Direct within Segment 


E9 +++ 




6 




6 








Register/Memory Indirect Within Segment 


FF ImodlOOr/m] 




6/8 


10 


6/8 


10 






Direct Intersegment 


EA [full offset, selector] 




9 




26 








Call Gate Same Privilege Level 










45 


45 






16-bit Task to 16-bit TSS 










265 


266 






16-bit Task to 32-bit TSS 










296 


320 






16-bit Task to V86 Task 










182 


209 






32-bit Task to 16-bit TSS 










241 


261 






32-bit Task to 32-bit TSS 










299 


343 






32-bit Task to V86 Task 










185 


232 






Indirect Intersegment 


FF [modlOlr/m] 




11 


14 


30 


30 






Call Gate Same Privilege Level 










47 


47 






16-bit Task to 16-bit TSS 










270 


271 






16-bit Task to 32-bit TSS 










301 


325 






16-bit Task to V86 Task 










184 


214 






32-bit Task to 16-bit TSS 










246 


266 






32-bit Task to 32-bit TSS 










304 


348 






32-bit Task to V86 Task 










187 


237 







5? 



JNB/JAE/JNC Jump on Not Below/Ahove or 
Equal/Not Carry 
8-bit Displacement 
Full Displacement 


73 + 

OF 83+++ 




611 
611 




611 
611 






r 





JNBE/JA Jump on Not Below or Equal/Above 
8-bit Displacement 
Full Displacement 


77 + 

OF 87+++ 




611 
611 




611 
611 






r 





JNE/JNZ Jump on Not Equal/Not Zero 
8-bit Displacement 
Full Displacement 


75 + 

OF 85+++ 




611 
611 




611 
611 






r 





JNL/JGE Jump on Not Less/Greater or Equal 
8-bit Displacement 
Full Displacement 


7D + 

OF 8D+++ 




611 
611 




611 
611 






r 





# = immediate data 
+ = 8-bit displacement 



= 16-bit displacemem x = modified 

: 32-bit displacement (full) - = unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


RIAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DP IF TF SF ZF AF PF CF 


aeg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 





JNLE/JG Jump on Not Less or Equal/Greater 
8-bit Displacement 
Full Displacement 


7F + 

OF 8F +++ 




611 
611 




611 
611 






r 





JNO Jump on Not Overflow 
8-bit Displacement 
Full Displacement 


71 + 

OF 81+++ 




611 
611 




611 
611 






r 








JNP/JPO Jump on Not Parity /Parity Odd 
8-bit Displacement 
Full Displacement 


7B + 

OF 8B +++ 




611 
611 




611 
611 






r 





JNS Jump on Not Sign 
8-bit Displacement 
Full Displacement 


79 + 

OF 89+++ 




611 
611 




611 
6il 






r 





z 

5 



JO Jump on Overflow 
8-bit Displacement 
Full Displacement 


70 + 

OF 80+++ 




611 
61 1 




611 
611 






r 





JP/JPE Jump on Parity/Parity Even 
8-bit Displacement 
Full Displacement 


7A + 

OF 8A+++ 




611 
611 




611 
611 






r 





JS Jump on Sign 
8-bit Displacement 
Full Displacement 


78 + 

OF 88 +++ 




611 
611 




611 
611 






r 





LAHF Load AH with Flags 



9F 



6^ 



LAR Load Access Rights 
From Register/Memory 


OF 02 [mod reg r/m] 


X 






11/12 


14 


a 


g.h,j,p 



# = immediate data 
+ = 8-bit displacement 



■- 16-bit displacement x = modified 

= 32-bit displacement (full) - = unchanged 



M 
^ 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF IF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



LDS Load Pointer to DS 



C5 [mod reg r/m] 



7 I 23 



24 



h,i,j 



LEA Load Effective Address 
No Index Register 
With Index Register 


8D [mod reg r/m] 




2 
3 




2 
3 



















I 





















\ 1 (ITiT T nnfl CtDT Ji('(Ti<:tcr OF 01 fmnrl 01 r/ml .-. -___. Q Q Q Q hr hi 












\ 11T%T T nnri inT Tlpaictfr OP 01 fmnrl 01 1 r/ml OQOQIhrVil 





LLDT Load LDT Register 
From Register/Memory 


OF 00 [mod 010 r/m] 








16/17 


18 


a 


g,ho,l 





LMSW Load Machine Status Word 
From Register/Memory 



OF 01 [mod 110 r/m] 



b,c 



h,l 



LODS Load String 



A[110w] 



LOOP Offset Loop/No Loop 



E2 



913 



913 



I LOOPNZA.OOPNE Ofset 



913 



: immediate data 
= 8-bit displacement 



: 16-bit displacement 

■ 32-bit displacement (full) 



: modified 
= unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Mode 



I LOOPZ/LOOPE Offset 



El 



913 



913 



LSL Load Segment Limit 
From Register/Memory 


OF 03 [mod reg r/m] 


X - - - 






22/23 


25 


a 


g.h,j,p 



LSS Load Pointer to SS 



I OF B2 [mod reg r/m] 



23 



h,io 



LTR Load Task Register 
From Register/Memory 


OF 00 [mod reg r/m] 








16/17 


18 


a 


g,hj,l 



















b 


h i i 


Register to Register/Memory 


8 [lOOw] [mod reg r/m] 




1/2 


2 


1/2 


2 




".iJ 


Register/Memory to Register 


8 [lOlw] [mod reg r/m] 




1/2 


4 


1/2 


4 






Immediate to Register/Memory 


C[011w] [mod 000 r/m] # 




1/2 


2 


1/2 


2 






Immediate to Register (sliort form) 


B [w reg] # 




1 




1 








Memory to Accumulator (sliort form) 


A [OOOw] +++ 




2 


4 


2 


4 






Accumulator to Memory (short form) 


A [OOlw] +++ 




1/2 


2 


1/2 


2 






Register/Memory to Segment Register 


8E [mod sreg3 r/m] 




2/3 


5 


15/16 


18 






Segment Register to Register/Memory 


8C [mod reg r/m] 




1/2 


2 


1/2 


2 







MOV Move to/jrom<:ontrol/Dehug/Test Regs 


















1 




Register to CR0/CR2/CR3 


OF 


22[lleeereg] 




11/3/3 




11/3/3 








CR0/CR2/CR3 to Register 


OF 


20 [lleeereg] 




1/3/3 




1/3/3 








Register to DR0-DR3 


OF 


23[lleeereg] 




1 




1 








DR0-DR3 to Register 


OF 


21 [lleeereg] 




3 




3 








Register to DR6-DR7 


OF 


23 [lleeereg] 




1 




1 








DR6-DR7 to Register 


OF 


21 [lleeereg] 




3 




3 








Register to TR3-5 


OF 


26 [lleeereg] 




5 




5 








TR3-5 to Register 


OF 


24 [lleeereg] 




5 




5 








Register to TR6-TR7 


OF 


26 [lleeereg] 




1 




1 








TR6-TR7 to Register 


OF 


24 [lleeereg] 




3 




3 









1^ 








-■ immediate data 
= 8-bit displacement 



= 16-bit displacement 

: 32-bit displacement (full) 



modified 
unchanged 



1^ 



HNSTRUCTION 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF TF SF ZIF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



MOVSX Move with Siffi Extension 
Register from Register/Memory 



MOVZX Move with Zero Extension 
Register from Register/Memory 



OF B[lllw] [modregr/m] 



OF B [Ollw] [mod reg r/m] 



1/3 



2/3 



2/3 






MUL Unsigned Multiply 

Accumulator with Register/Memory 
Multiplier - Byte 
-Word 
- Doubleword 


F[011w] [mod 100 r/m] 


X ------- X 


3/5 
3/5 
7/9 


7 
7 
13 


3/5 
3/5 
7/9 


7 
7 
13 


b 


h 



•3 



NEG Negate Integer 



F[011w] [mod Oil r/m] 



X X X X X 



1/3 



Z 
3 



I NOP No Operation 



I NOT Boolean Complement 



90 



F[011w] [mod 010 r/m] 



1/3 



OR Boolean OR 




0---xxxxO 










b 


h 


Register to Register 


0[10dw] [11 reg r/m] 




1 




1 








Register to Memory 


[lOOw] [modregr/m] 




3 


5 


3 


5 






Memory to Register 


[lOlw] [modregr/m] 




3 


5 


3 


5 






Immediate to Register/Memory 


8[000w] [mod 001 r/m] # 




1/3 


5 


1/3 


5 






Immediate to Accumulator 


0[110w] # 




1 




1 









OUT Output to Port 
Fixed Port 
Variable Port 



E[011w] [port number] 
E[lllw] 



18 
18 



18 
18 



4\17 
4\I7 



4\18 
4\18 



\OVTS Output String 



)[lllw] 



20 



6\19 



h,m 



# = immediate data 
+ = 8-bit displacement 



= 16-bit displ: 
+ = 32-bit displ; 



X = modified 
(full) - = unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF 0¥ IF IF SF ZF AF PF CF 


Reg/ 
Cache Hifl 


Cache 
Miss 


Reg/ 
Cache Hifi 


Cache 
Miss 


Real 
Mode 


Mode 



FOV Pop Value off Stack 














b 


h,i,j 




Register/Memory 


8F [mod 000 r/m] 




3/5 


4/5 


3/5 


4/5 






Register (short form) 


5 [1 reg] 




3 


4 


3 


4 






Segment Register (ES, CS, SS, DS) 


[OOOsreglllO] 




4 


5 


18 


19 






Segment Register (ES, CS, SS, DS, FS, GS) 


OF' [10sreg3 001] 




4 


5 


18 


19 







1 POPA Pop All General Re^sters 


1 61 


1 1 


18 


1 18 1 


18 


1 18 


1 b 1 


h 1 


1 1 




1 POPF Pop Stack into FLAGS 


1 9D 


xxxxxxxxx 


4 


1 5 1 


4 


1 5 


1 b 1 


h,n 1 



iS 



5 



HI 



PREFIX BYTES 

Assert Hardware LOCK Prefix 
Address Size Prefix 
Operand Size Prefix 
Segment Override Prefix 

CS 

DS 

ES 

FS 

GS 

SS 


FO 
67 
66 

2E 
3E 
26 
64 
65 
36 














m 





PUSH Push Vdue onto Stack 
Register/Memory 














b 


h 


FF [mod 110 r/m] 




2/4 


4 


2/4 


4 






Register (short form) 


5[0reg] 




. 2 


2 


2 


2 






Segment Register (ES, CS, SS, DS) 


[OOOsreglllO] 




2 


2 


2 


2 






Segment Register (ES, CS, SS, DS, FS, GS) 


OF [10sreg3 000] 




2 


2 


2 


2 






Immediate 


6[10s0] # 




2 


2 


2 


2 







1 PUSHA Push All General Registers 


l60 1 - 


- - - - - - 1 17 


1 17 1 


17 


1 17 


1 b 1 


h 1 








1 PUSHF Push FLAGS Register 




_ . . _ _ _ _ . 1 2 


1 ^ 1 


2 


1 2 


b 1 


h 1 







= immediate data 
= 8-bit displ: 



= 16-bit displacement x = modified 

= 32-bit displacement (full) - = unchanged 



Ill 

0^ 



79 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF IF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Mode 



REP INS Input String 



I REP LOPS Load String 



RCL Rotate Through Carry Left 




X ------- X 










b 


h 


Register/Memory by 1 


D[000w] [modOlOr/m] 




9/9 


10 


9/9 


10 






Register/Memory by CL 


D[001w] [modOlOr/m] 




9/9 


10 


9/9 


10 






Register/Memory by Immediate 


C[000w] [mod010r/m]# 




9/9 


10 


9/9 


10 







F2 6[110w] 



F2 A[110w] 



20+9n 



5+9n\ 
18+9n 



5+9n\ 
19+9n 



4+5n 4+5n 



4+5n 4+5n 



h,m 



5? 



RCR Rotate Through Carry Right 




X ------- X 










b 


h 


Register/Memory by 1 


D[000w] [modOllr/m] 




■ 9/9 


10 


9/9 


10 






Register/Memory by CL 


D[001w] [modOllr/m] 




9/9 


10 


9/9 


10 






Register/Memory by Immediate 


C[000w] [mod011r/m]# 




9/9 


10 


9/9 


10 







z 
> 

5 



I REP MOVS Move String 



F2 A [OlOw] 



5+4n 5+4n 



REP OUTS Output String 



F2 6[lllw] 



20+4n 20+4n 



5+4n\ 
18+4n 



5+4n\ 
19+4n 



h,m 



I REP STOS Store String 



F2 A [lOlw] 



3+4n 3+4n 



3+4n 3+4n 



REPE CMPS Compare String 
(Find non-match) 


F3 A[011w] 


X---XXXXX 


5+8n 


5+8n 


5+8n 


5+8n 


b 


h 



REPE SCAS Scan String 

(Findnon-AUAX/EAX) 


F3 A[lllw] 


X---XXXXX 


4+5n 


4+6n 


4+5n 


4+6n 


b 


h 



REPNE CMPS Compare String 
(Find match) 


F2 A[011w] 


X---XXXXX 


5+8n 


5+8n 


5+8n 


5+8n 


b 


h 



REPNE SCAS Scan String 

(FindAUAX/EAX) 


F2 A[lllw] 


X---XXXXX 


4+5n 


4+6n 


4+5n 


4+6n 


b 


h 



# = immediate data 
+ = 8-bit displi 



= 16-bit displacement x = modified 

= 32-bit displacement (full) - = unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF IF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Mode 



1 

RET Return from Subroutine 
Within Segment 














b 


g,h,j,k,r 


C3 




10 




10 




Within Segment Adding Immediate to SP 


C2 ++ 




10 




10 








Intersegment 


CB 




13 


13 


26 


26 






Intersegment Adding Immediate to SP 


CA ++ 




13 


13 


26 


27 






Protected Mode: Different Privilege Level 


















Intersegment 










69 


72 






Intersegment Adding Immediate to SP 










69 


72 







m 

i 

I 



1^ 



ROL Rotate Left 




X ------- X 










b 


h 


Register/Memory by 1 


D [OOOw] [mod 000 r/m] 




2/4 


6 


2/4 


6 






Register/Memory by CL 


DfOOlwl [mod 000 r/m] 




3/5 


7 


3/5 


7 






Register/Memory by Immediate 


CIOOOw] [mod 000 r/m] # 




2/4 


6 


2/4 


6 







SAHF Store AH in FIAGS 



ROR Rotate Right 




X ------- X 










b 


h 


Register/Memory by 1 


D[000w] [mod 001 r/m] 




2/4 


6 


2/4 


6 






Register/Memory by CL 


D[001w] [mod 001 r/m] 




3/5 


7 


3/5 


7 






Register/Memory by Immediate 


C[000w] [mod 001 r/m] # 




2/4 


6 


2/4 


6 







9E 



X X X X X 



SAL Shift Left Arithmetic 




X---XX-XX 










b 


h 


Register/Memory by 1 


D[000w] [mod 100 r/m] 




2/4 


6 


2/4 


6 






Register/Memory by CL 


D[001w] [mod 100 r/m] 


' 


3/5 


7 


3/5 


7 






Register/Memory by Immediate 


C[000w] [mod 100 r/m] # 




2/4 


6 


2/4 


6 







SAR Shift Right Arithmetic 




X---XX-XX 










b 


h 


Register/Memory by 1 


D[000w] [mod 111 r/m] 




2/4 


6 


2/4 


6 






Register/Memory by CL 


D[001w] [mod 111 r/m] 




3/5 


7 


3/5 


7 






Register/Memory by Immediate 


C[000w] [mod HI r/m] # 




2/4 


5 


2/4 


6 







SBB Integer Subtract with Borrow 




X---XXXXX 










b 


h 


Register to Register 


l[10dw] [llregr/m] 




1 




1 








Register to Memory 


1 [lOOw] [modregr/m] 




3 


5 


3 


5 






Memory to Register 


1 [lOlw] [modregr/m] 




3 


5 


3 


5 






Immediate to Register/Memory 


8[00sw] [mod Oil r/m] # 




1/3 


5 


1/3 


5 






Immediate to Accumulator (short form) 


1 [llOw] # 




1 




1 









€9 



s 



S 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF IF SF ZIF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Mode 



SCAS Scan String 



A[lllw] 



- X X X X X 



SETB/SETNAE/SETC Set Byte on Below/Not 

Above or Equal/Carry 
To Register/Memory 



OF 92 [mod 000 r/m] 



SETE/SETZ Set Byte on Equal/Zero 
To Register/Memory 



OF 94 [mod 000 r/m] 



2/2 



2/2 



# = immediate data ++ = 16-bit displacement x = modified 

+ = 8-bit displacement +++ = 32-bit displacement (full) - = unchanged 



5 b 



SETBE/SETNA Set Byte on Below or 
Equal/Not Above 
To Register/Memory 


OF 96 [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 





SETL/SETNGE Set Byte on Less/Not Greater 
or Equal 
To Register/Memory 


OF 9C [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 


■ 



SETLE/SETNG Set Byte on Less or Equal/Not 
Greater 
To Register/Memory 


OF 9E [mod 000 r/m] 




2/2 


2 


2/2 


2 




li 





SETNB/SETAE/SETNC Set Byte on Not Below/ 
Above or Equal/Not Carry 
To Register/Memory 


OF 93 [mod 000 r/m] 




2/2 


2 


in. 


2 




li 





. SETNBE/SETA Set Byte on Not Below or 
Equal/Above 
To Register/Memory 


OF 97 [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 





SETNE/SETNZ Set Byte on Not Equal/Not 
Zero 
To Register/Memory 


OF 95 [mod 000 r/m] 




in 


2 


2/2 


2 




h 








INSTRUCTION 


OPCODE 


FL^GS 


RIAL 

MODi CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


aeg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



SETNL/SETGE Set Byte on Not Less/Greater 
or Equal 
To Register/Memory 


OF 9D [mod 000 r/m] 




2/2 


2 


1 

2/2 


2 


1 


h 





SETNLE/SETG Set Byte on Not Less or 
Equal/Greater 
To Register/Memory 


OF 9F [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 





SETNO Set Byte on Not Overflow 
To Register/Memory 



OF 91 [mod 000 r/m] 



2/2 



■9 



SETNP/SETPO Set Byte on Not 
Parity/Parity Odd 
To Register/Memory 


OF 9B [mod 000 r/m] 




2/2 


2' 


2/2 


2 




h 





5 



SETNS Set Byte on Not Sign 
To Register/Memory 



SETO Set Byte on Overflow 
To Register/Memory 



OF 99 [mod 000 r/m] 



OF 90 [mod 000 r/m] 



SETP/SETPE Set Byte on Parity/Parity Even 
To Register/Memory 



OF 9A [mod 000 r/m] 



SETS Set Byte on Sign 
To Register/Memory 



OF 98 [mod 000 r/m] 



SGDT Store GDT Register 
To Register/Memory 



OF 01 [mod 000 r/m] 



2/2 



2/2 



2/2 



# = immediate data ++ = 16-bit displacement x = modified 

+ = 8-bit displacement +++ = 32-bit displacement (full) - = unchanged 



IS 



b,c 






7S 



5 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



SHL Shift Left Logica! 




X - - - X X - X X 










b 


h 


Register/Memory by 1 


D [OOOw] [mod 100 r/m] 




2/4 


6 


2/4 


6 


Register/Memory by CL 


D[001w] [mod 100 r/m] 




3/5 


7 


3/5 


7 






Register/Memory by Immediate 


C[000w] [mod 100 r/m] # 




2/4 


6 


2/4 


6 







SHLDShiJtUjt Double 
Register/Memory by Immediate 
Register/Memory by CL 


OF A4 [mod reg r/m] # 
OF A5 [mod reg r/m] 


----XX-XX 


1/3 
3/5 


5 
7 


1/3 
3/5 


5 
7 







SHR Shift Right Logical 




X - - - X X - X X 










b 


li 


Register/Memory by 1 


D[000w] [mod 101 r/m] 




2/4 


6 


2/4 


6 






Register/Memory by CL 


D[001w] [mod 101 r/m] 




3/5 


7 


3/5 


7 






Register/Memory by Immediate 


C [OOOw] [mod 101 r/m] # 




2/4 


5 


2/4 


6 







SHBD Shift Right Double 
Register/Memory by Immediate 
Register/Memory by CL 


OF AC [mod reg r/m] # 
OF AD [mod reg r/m] 


----XX-XX 


1/3 
3/5 


5 
7 


1/3 
3/5 


5 
7 







SIDT Store IDT Register 
To Register/Memory 



OF 01 [mod 001 r/m] 



# = immediate data 
+ = 8-bit displacement 



■■ 16-bit displacement x = modified 

: 32-bit displacement (full) - = unchanged 



SLDT Store LOT Re^ster 
To Register/Memory 


OF 00 [mod 000 r/m] 








1/2 


2 


a 


h 





1 SM SW Store Machine Status Word 


1 OF 01 [mod 100 r/m] 




1 


1/2 


2 


1/2 


1 ^ 


1 ^'^ 1 


h,l 1 








1 STC Set Carry Hag 


|f9 




- - 1 1 


1 




1 


1 








1 STD Set Direction Flag 


1 FD 


I 


1 


1 




1 


1 


1 1 


1 




1 


1 




\STI Set Interrupt Flag 


PB 


. . 1 . - 


. 1 


7 




7 


1 


1 1 


m 1 



i 

^ 



D 



ei^smucTioii 


op^eo^e 


FLAGS 


EliAL 
MO^i CE.OCIC 


mOBE CLOCH 


E^OTSS 


OF DF IW W SP ZF AF PF CF 


^eg/ 
Cache Hit 


Cache 
Miss 


^eg/ 
Cache Hit 


Cache 
Miss 


Seal 
Mode 


Protected 
Mode 



STOS Store String 



A [lOlw] 



STR Store Tasfe Register 
To Register/Memory 


OF 00 [mod 001 r/m] 








1/2 


2 


a 


h 








SUB Integer SuJjtracf 




X - - - X X X X X • 










b 


h 


Register to Register 


2[10dw] [llregr/m] 




1 




1 








Register to Memory 


2 [lOOw] [modregr/m] 




3 


5 


3 


5 






Memory to Register 


2 [lOlw] [modregr/m] 




3 


5 


3 ' 


5 






Immediate to Register/Memory 


8 [OOsw] [mod 101 r/m] # 




1/3 


5 


1/3 


5 






Immediate to Accumulator (short form) 


2[110w]# 




1 




1 









TEST Test Bits 




- - - X X - X 










b 


h 


Register/Memory and Register 


8 [OlOw] [modregr/m] 




1/3 


5 


1/3 


5 






Immediate Data and Register/Memory 


F[011w] [mod 000 r/m] # 




1/3 


5 


1/3 


5 






Immediate Data and Accumulator 


A[100w]# 




1 




1 









I 



VERR Verify Read Access 
To Register/Memory 


OF 00 [mod 100 r/m] ' 


X 






9/10 


12 


a 


g>h0,p 



\ERW Verify Write Access 
To Register/Memory 


OF 00 [mod 101 r/m] 


X - - - 






9/10 


12 


a 


g.ho,p 



WAIT Wait Until FPU Not Busy 



WBINVD Write-Back and Invalidate Cache 



XADD Exchange and Add 
Register l,Register2 
Memory, Register 


0FC[000w] [llreg2regl] 
OF C [OOOw] [mod reg r/m] 


X---XXXXX 


3 
6 


6 


3 
6 


6 







= immediate data 
= 8-bit displ: 



= 16-bit displacement x = modified 

-■ 32-bit displacement (full) - = unchanged 



Id 



INSTRUCTDON 


OPCODE 


FLAGS 


REAL 

MODE CLOCK 

COUNT 


PROTECTED 

MODE CLOCK 

COUNT 


NOTES 


OF DF IF 17 SF ZF /iF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



XCHG Exchange 
Register/Memory witli Register 
Register witli Accumulator 



8 [Ollw] [mod reg r/m] 

9 [0 reg] 



3/4 
3 



3/4 
3 



b,f 



f,h 



5? 



XIAT Translate Byte 



D7 



IS 



5 



XOR Boolean Exclusive OR 

Register to Register 

Register to Memory 

Memory to Register 

Immediate to Register/Memory 

Immediate to Accumulator (short form) 


3[00dw] [llregr/m] 
3 [OOOw] [mod reg r/m] 
3 [00 Iw] [mod reg r/m] 
8[00sw] [mod 110 r/m] # 
3 [OlOw] # 


- - - X X - X 


1 
3 
3 
1/3 

1 


5 
5 

5 


1 
3 
3 
1/3 

1 


5 
5 
5 


b 


h 



= immediate data 
= 8-bit displacement 



■■ 16-bit displacement x = modified 

: 32-bit displacement (full) - = unchanged 



Instruction Notes for Instruction Set Summary 

Notes a through c apply to Real Address Mode only: 

a. Tliis is a Protected Mode instruction. Attempted execution in Real Mode will result in exception 6 (invalid op-code). 

b. Exception 1 3 fault (general protection) will occur in Real Mode if an operand reference is made that partially or fully extends beyond the maximum CS, DS, ES, FS, or GS segment limit 
(FFFFH). Exception 12 fault (stack segment limit violation or not present) will occur in Real Mode if an operand reference is made that partially or fully extends beyond the maximum SS 
limit. 

c. This instruction may be executed in Real Mode. In Real Mode, its purpose is primarily to initialize the CPU for Protected Mode. 

Notes e through g apply to Real Address Mode and Protected Virtual Address Mode: 

e. An exception may occur, depending on the value of the operand. • 

f. LOCK# is automatically asserted, regardless of the presence or absence of the LOCK prefix. 

g. LOCK# is asserted during descriptor table accesses. 

Notes h through r apply to Protected Virtual Address Mode only: 

h. Exception 13 fault will occur if the memory operand in CS, DS, ES, FS, or GS cannot be used due to either a segment limit violation or an access rights violation. If a stack limit is violated, 

an exception 12 occurs, 
'i. For segment load operations, the CPL, RPL, and DPL must agree v^th the privilege rules to avoid an exception 13 fault. The segment's descriptor must indicate "present" or exception 1 1 

(CS, DS, ES, FS, GS not present). If the SS register is loaded and a stack segment not present is detected, an exception 12 occurs, 
j. All segment descriptor accesses in the GDT or LDT made by this instruction will automatically assert LOCK# to maintain descriptor integrity in multiprocessor systems, 
k. JMP, CALL, INT, RET, and IRET instructions referring to another code segment will cause an exception 13, if an applicable privilege rule is violated. 
1. An exception 13 fault occurs if CPL is greater than (0 is the most privileged level), 
m. An exception 13 fault occurs if CPL is greater than lOPL. 

n. The IF bit of the flag register is not updated if CPL is greater than lOPL. The lOPL and VM fields of the flag register are updated only if CPL = 0. 
o. The PE bit of the MSW (CRO) cannot be reset by this instruction. Use MOV into CRO if desiring to reset the PE bit. 
p. Any violation of privilege rules as apply to the selector operand does not cause a Protection exception, rather, the zero flag is cleared, 
q. If the coprocessor's memory operand violates a segment limit or segment access rights, an exception 13 fault will occur before the ESC instruction is executed. An exception 12 fault will 

occur if the stack limit is violated by the operand's starting address, 
r. The destination of a JMP, CALL, INT, RET, or IRET must be in the defined limit of a code segment or an exception 13 fault will occur. 



Ordering Information 



Ordering InfomicalioBi 



Cyrix Prefix 

Device Name 
486SLC 

Voltage 

Blank = 5 volts 

V = 3 volts 
Speed 

25 = 25 MHz 



CX 486SLC - V 

J ' 



25 Q P 



Package Type 

Q = Quad Flat Pak 

Temperature Range 

P = Commercial 



The currently available Cyrix Cx486SLC part numbers are listed below: 



Cx486SLC Pfirt ^ymbers 



PAmNUMBEH 


HESCiliPTiON 


Cx486SLC-25-QP 


5 V, 25 MHz, QFP Package 


Cx486SLC-V20-QP 


3 V, 20 MHz, QFP Package 



SALES OFFICES 



us 

Cyrix Corporation 

2703 North Central Exprressway 

Richardson, TX 75080 

Tel: (214)234-8387 

Fax: (214)699-9857 



Europe 

Cyrix Europe HQ 

603 Delta Business Park 

Weldon Road 

Swindon Road, SN57XF UK 

Tel: 011-44-793-417-779 

Fax: 011-44-793-417-788 



Taiwan & Hong Kong 

ACCEL Technology Corp. 
3F-l,678Tun-HuaS.Rd. 
Taipei, Taiwan, R.O.C. 
Tel: 011-886-02-755-2838 
Fax: 011-886-02-708-0878 



Japan 

Cyrix KK 

7FNisso 11 Bldg, 2-3-4 

Shin-Yokohama, Koh-Hoku-Ku 

Yokohama, 222 Japan 

Tel: 011-81-45-471-1661 

Fax: 011-81-45-471-1666 



Canada 

Kaytronics 
5800 Thimens Blvd. 
Ville St. Laurent 
Quebec H4S-1S5 
Tel: (514)745-6800 
Fax: (514)745-5858 
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